From 5bf1c1c3b5835fc4be9de2e56eab3dd9d93f8a6a387f3cd34f74dc41ab88e82f Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Wed, 13 Jul 2016 07:20:10 +0000 Subject: [PATCH 1/4] Accepting request 406824 from home:MargueriteSu:branches:security:SELinux OBS-URL: https://build.opensuse.org/request/show/406824 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libsepol?expand=0&rev=53 --- libsepol-2.3.tar.gz | 3 --- libsepol-2.5.tar.gz | 3 +++ libsepol.changes | 56 +++++++++++++++++++++++++++++++++++++++++++++ libsepol.spec | 9 +++++--- 4 files changed, 65 insertions(+), 6 deletions(-) delete mode 100644 libsepol-2.3.tar.gz create mode 100644 libsepol-2.5.tar.gz diff --git a/libsepol-2.3.tar.gz b/libsepol-2.3.tar.gz deleted file mode 100644 index 6eb94d0..0000000 --- a/libsepol-2.3.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:cc8d8642c3b7b95d6928d65dcbca2ab0627abc1c05166637851e63c1a6eae68f -size 209570 diff --git a/libsepol-2.5.tar.gz b/libsepol-2.5.tar.gz new file mode 100644 index 0000000..3f29ebc --- /dev/null +++ b/libsepol-2.5.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2bdeec56d0a08b082b93b40703b4b3329cc5562152f7254d8f6ef6b56afe850a +size 438730 diff --git a/libsepol.changes b/libsepol.changes index a06168d..c1e28f1 100644 --- a/libsepol.changes +++ b/libsepol.changes @@ -1,3 +1,59 @@ +------------------------------------------------------------------- +Tue Jul 5 17:11:44 UTC 2016 - i@marguerite.su + +- update version 2.5 + * Fix unused variable annotations + * Fix uninitialized variable in CIL + * Validate extended avrules and permissionxs in CIL + * Add support in CIL for neverallowx + * Fully expand neverallowxperm rules + * Add support for unordered classes to CIL + * Add neverallow support for ioctl extended permissions + * Improve CIL block and macro call recursion detection + * Fix CIL uninitialized false positive in cil_binary + * Provide error in CIL if classperms are empty + * Add userattribute{set} functionality to CIL + * fix CIL blockinherit copying segfault and add macro restrictions + * fix CIL NULL pointer dereference when copying classpermission/set + * Add CIL support for ioctl whitelists + * Fix memory leak when destroying avtab + * Replace sscanf in module_to_cil + * Improve CIL resolution error messages + * Fix policydb_read for policy versions < 24 + * Added CIL bounds checking and refactored CIL Neverallow checking + * Refactored libsepol Neverallow and bounds (hierarchy) checking + * Treat types like an attribute in the attr_type_map + * Add new ebitmap function named ebitmap_match_any() + * switch operations to extended perms + * Write auditadm_r and secadm_r roles to base module when writing CIL + * Fix module to CIL to only associate declared roleattributes with in-scope types + * Don't allow categories/sensitivities inside blocks in CIL + * Replace fmemopen() with internal function in libsepol + * Verify users prior to evaluating users in cil + * Binary modules do not support ioctl rules + * Add support for ioctl command whitelisting + * Don't use symbol versioning for static object files + * Add sepol_module_policydb_to_cil(), sepol_module_package_to_cil(), + and sepol_ppfile_to_module_package() + * Move secilc out of libsepol + * fix building Xen policy with devicetreecon, and add devicetreecon + CIL documentation + * bool_copy_callback set state on creation + * Add device tree ocontext nodes to Xen policy + * Widen Xen IOMEM context entries + * Fix error path in mls_semantic_level_expand() + * Update to latest CIL, includes new name resolution and fixes ordering + issues with blockinherit statements, and bug fixes +- changes in 2.4 + * Remove assumption that SHLIBDIR is ../../ relative to LIBDIR + * Fix bugs found by hardened gcc flags + * Build CIL into libsepol. libsepol can be built without CIL by setting the + DISABLE_CIL flag to 'y' + * Add an API function to set target_platform + * Report all neverallow violations + * Improve check_assertions performance + * Allow libsepol C++ static library on device + ------------------------------------------------------------------- Fri May 16 13:06:12 UTC 2014 - vcizek@suse.com diff --git a/libsepol.spec b/libsepol.spec index 8f28c0f..50a54a4 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -1,7 +1,7 @@ # # spec file for package libsepol # -# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,15 +17,16 @@ Name: libsepol -Version: 2.3 +Version: 2.5 Release: 0 Url: http://www.nsa.gov/selinux/ Summary: SELinux binary policy manipulation library License: LGPL-2.1+ Group: System/Libraries -Source: http://userspace.selinuxproject.org/releases/20140506/%{name}-%{version}.tar.gz +Source: http://userspace.selinuxproject.org/releases/20160223/%{name}-%{version}.tar.gz Source2: baselibs.conf BuildRoot: %{_tmppath}/%{name}-%{version}-build +BuildRequires: flex BuildRequires: pkg-config %description @@ -127,7 +128,9 @@ rm -rf $RPM_BUILD_ROOT%{_mandir}/man8 %{_libdir}/libsepol.so %{_mandir}/man3/* %dir %{_includedir}/sepol +%dir %{_includedir}/sepol/cil %{_includedir}/sepol/*.h +%{_includedir}/sepol/cil/cil.h %dir %{_includedir}/sepol/policydb %{_includedir}/sepol/policydb/*.h %{_libdir}/pkgconfig/libsepol.pc From 2a1654c87fcf0eb3b33b4f407a5355d9e0e85bdd36327b868c06633873b7ca23 Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Thu, 14 Jul 2016 08:42:10 +0000 Subject: [PATCH 2/4] Accepting request 408435 from home:jsegitz:branches:security:SELinux - Adjusted source link OBS-URL: https://build.opensuse.org/request/show/408435 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libsepol?expand=0&rev=54 --- libsepol.changes | 5 +++++ libsepol.spec | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/libsepol.changes b/libsepol.changes index c1e28f1..29da6e0 100644 --- a/libsepol.changes +++ b/libsepol.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Thu Jul 14 07:57:35 UTC 2016 - jsegitz@novell.com + +- Adjusted source link + ------------------------------------------------------------------- Tue Jul 5 17:11:44 UTC 2016 - i@marguerite.su diff --git a/libsepol.spec b/libsepol.spec index 50a54a4..22aeee2 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -23,10 +23,10 @@ Url: http://www.nsa.gov/selinux/ Summary: SELinux binary policy manipulation library License: LGPL-2.1+ Group: System/Libraries -Source: http://userspace.selinuxproject.org/releases/20160223/%{name}-%{version}.tar.gz +Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20160223/%{name}-%{version}.tar.gz Source2: baselibs.conf BuildRoot: %{_tmppath}/%{name}-%{version}-build -BuildRequires: flex +BuildRequires: flex BuildRequires: pkg-config %description From e8f8aa2672e8c7267678a6179ad9c3cdd5998eb6917e5d59b53adc4cc93846ca Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Thu, 14 Jul 2016 14:27:06 +0000 Subject: [PATCH 3/4] Accepting request 408534 from home:jsegitz:branches:security:SELinux - Without bug number no submit to SLE 12 SP2 is possible, so to make sle-changelog-checker happy: bsc#988977 OBS-URL: https://build.opensuse.org/request/show/408534 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libsepol?expand=0&rev=55 --- libsepol.changes | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libsepol.changes b/libsepol.changes index 29da6e0..5d6a28f 100644 --- a/libsepol.changes +++ b/libsepol.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Thu Jul 14 14:21:46 UTC 2016 - jsegitz@novell.com + +- Without bug number no submit to SLE 12 SP2 is possible, so to make + sle-changelog-checker happy: bsc#988977 + ------------------------------------------------------------------- Thu Jul 14 07:57:35 UTC 2016 - jsegitz@novell.com From fb01341895a6c23e09383e1fc4d4ef599af2d75650d559dd775d57f3c9631c44 Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Fri, 15 Jul 2016 12:59:30 +0000 Subject: [PATCH 4/4] Accepting request 408676 from home:pluskalm:branches:security:SELinux - Cleanup spec file with spec-cleaner - Make spec file a bit more easy - Ship new supbackage (-tools) OBS-URL: https://build.opensuse.org/request/show/408676 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libsepol?expand=0&rev=56 --- libsepol.changes | 7 ++++++ libsepol.spec | 55 +++++++++++++++++++++++++++++------------------- 2 files changed, 40 insertions(+), 22 deletions(-) diff --git a/libsepol.changes b/libsepol.changes index 5d6a28f..0aced8d 100644 --- a/libsepol.changes +++ b/libsepol.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Thu Jul 14 14:38:09 UTC 2016 - mpluskal@suse.com + +- Cleanup spec file with spec-cleaner +- Make spec file a bit more easy +- Ship new supbackage (-tools) + ------------------------------------------------------------------- Thu Jul 14 14:21:46 UTC 2016 - jsegitz@novell.com diff --git a/libsepol.spec b/libsepol.spec index 22aeee2..97318ea 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -19,15 +19,15 @@ Name: libsepol Version: 2.5 Release: 0 -Url: http://www.nsa.gov/selinux/ Summary: SELinux binary policy manipulation library License: LGPL-2.1+ Group: System/Libraries +Url: http://www.nsa.gov/selinux/ Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20160223/%{name}-%{version}.tar.gz Source2: baselibs.conf -BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: flex -BuildRequires: pkg-config +BuildRequires: pkgconfig +BuildRoot: %{_tmppath}/%{name}-%{version}-build %description Security-enhanced Linux is a feature of the Linux(R) kernel and a @@ -46,7 +46,26 @@ tools, as well as by programs like load_policy that need to perform specific transformations on binary policies such as customizing policy boolean settings. +%package utils +Summary: SELinux binary policy manipulation tools +Group: System/Base +%description utils +Security-enhanced Linux is a feature of the Linux(R) kernel and a +number of utilities with enhanced security functionality designed to +add mandatory access controls to Linux. The Security-enhanced Linux +kernel contains new architectural components originally developed to +improve the security of the Flask operating system. These architectural +components provide general support for the enforcement of many kinds of +mandatory access control policies, including those based on the +concepts of Type Enforcement(R), Role-based Access Control, and +Multi-level Security. + +libsepol provides an API for the manipulation of SELinux binary +policies. It is used by checkpolicy (the policy compiler) and similar +tools, as well as by programs like load_policy that need to perform +specific transformations on binary policies such as customizing policy +boolean settings. %package -n libsepol1 Summary: SELinux binary policy manipulation library @@ -69,22 +88,18 @@ tools, as well as by programs like load_policy that need to perform specific transformations on binary policies such as customizing policy boolean settings. - - %package devel Summary: Development Include Files and Libraries for SELinux policy manipulation Group: Development/Libraries/C and C++ Requires: glibc-devel Requires: libsepol1 = %{version} -Requires: pkg-config +Requires: pkgconfig %description devel The libsepol-devel package contains the libraries and header files needed for developing applications that manipulate binary policies. - - %package devel-static Summary: Development Include Files and Libraries for SELinux policy manipulation Group: Development/Libraries/C and C++ @@ -95,30 +110,26 @@ The libsepol-devel-static package contains the static libraries needed for developing applications that manipulate binary policies. - - %prep %setup -q %build -make %{?_smp_mflags} CC="%{__cc}" CFLAGS="$RPM_OPT_FLAGS $(getconf LFS_CFLAGS)" +export CFLAGS="%{optflags}" +make %{?_smp_mflags} %install -mkdir -p $RPM_BUILD_ROOT/%{_lib} -mkdir -p $RPM_BUILD_ROOT%{_libdir} -mkdir -p $RPM_BUILD_ROOT%{_includedir} -mkdir -p $RPM_BUILD_ROOT%{_bindir} -mkdir -p $RPM_BUILD_ROOT%{_mandir}/man{3,8} -make DESTDIR="$RPM_BUILD_ROOT" LIBDIR="$RPM_BUILD_ROOT%{_libdir}" SHLIBDIR="$RPM_BUILD_ROOT/%{_lib}" install -rm -f $RPM_BUILD_ROOT%{_bindir}/genpolbools -rm -f $RPM_BUILD_ROOT%{_bindir}/genpolusers -rm -f $RPM_BUILD_ROOT%{_bindir}/chkcon -rm -rf $RPM_BUILD_ROOT%{_mandir}/man8 +make DESTDIR=%{buildroot} LIBDIR="%{buildroot}%{_libdir}" SHLIBDIR="%{buildroot}/%{_lib}" install %post -n libsepol1 -p /sbin/ldconfig - %postun -n libsepol1 -p /sbin/ldconfig +%files utils +%defattr(-,root,root) +%{_bindir}/chkcon +%{_mandir}/man8/chkcon.8%{ext_man} +%{_mandir}/man8/genpolbools.8%{ext_man} +%{_mandir}/man8/genpolusers.8%{ext_man} + %files -n libsepol1 %defattr(-,root,root) /%{_lib}/libsepol.so.*