Changeset 178

Timestamp:

01/11/07 13:02:22 (2 years ago)

Author:

ccase

Message:

merged with upstream 07-01-11

Files:

• upstream/selinux/libselinux/ChangeLog (modified) (1 diff)
• upstream/selinux/libselinux/VERSION (modified) (1 diff)
• upstream/selinux/libselinux/include/selinux/selinux.h (modified) (2 diffs)
• upstream/selinux/libselinux/man/man3/selinux_binary_policy_path.3 (modified) (2 diffs)
• upstream/selinux/libselinux/man/man3/selinux_check_securetty_context.3 (added)
• upstream/selinux/libselinux/man/man3/selinux_securetty_types_path.3 (added)
• upstream/selinux/libselinux/src/file_path_suffixes.h (modified) (1 diff)
• upstream/selinux/libselinux/src/selinux_check_securetty_context.c (added)
• upstream/selinux/libselinux/src/selinux_config.c (modified) (2 diffs)
• upstream/selinux/libselinux/src/selinux_internal.h (modified) (2 diffs)
• upstream/selinux/libselinux/utils/matchpathcon.c (modified) (3 diffs)
• upstream/selinux/libselinux/utils/selinux_check_securetty_context.c (added)
• upstream/selinux/libsemanage/ChangeLog (modified) (2 diffs)
• upstream/selinux/libsemanage/VERSION (modified) (1 diff)
• upstream/selinux/libsemanage/src/conf-parse.y (modified) (5 diffs)
• upstream/selinux/libsemanage/src/conf-scan.l (modified) (1 diff)
• upstream/selinux/libsemanage/src/direct_api.c (modified) (11 diffs)
• upstream/selinux/libsemanage/src/semanage_conf.h (modified) (1 diff)
• upstream/selinux/libsemanage/src/semanage_store.c (modified) (1 diff)
• upstream/selinux/policycoreutils/ChangeLog (modified) (1 diff)
• upstream/selinux/policycoreutils/VERSION (modified) (1 diff)
• upstream/selinux/policycoreutils/newrole/newrole.c (modified) (2 diffs)
• upstream/selinux/policycoreutils/po/kn.po (modified) (6 diffs)
• upstream/selinux/policycoreutils/scripts/fixfiles (modified) (1 diff)
• upstream/selinux/policycoreutils/semanage/seobject.py (modified) (7 diffs)
• upstream/selinux/policycoreutils/semodule/semodule.8 (modified) (1 diff)
• upstream/selinux/policycoreutils/semodule/semodule.c (modified) (2 diffs)

upstream/selinux/libselinux/ChangeLog

@@ +1 @@
+1.33.4 2006-01-11
+        * Merged selinux_check_securetty_context() and support from Dan Walsh.
+
-1.33.3 2007-01-04
-        * Merged patch for matchpathcon utility to use file mode information

upstream/selinux/libselinux/VERSION

@@ -1 @@
-3
+4

upstream/selinux/libselinux/include/selinux/selinux.h

@@ -407 +407 @@
-        extern const char *selinux_media_context_path(void);
-        extern const char *selinux_contexts_path(void);
+        extern const char *selinux_securetty_types_path(void);
-        extern const char *selinux_booleans_path(void);
-        extern const char *selinux_customizable_types_path(void);
@@ -419 +420 @@
-        extern int selinux_check_passwd_access(access_vector_t requested);
-        extern int checkPasswdAccess(access_vector_t requested);
+
+/* Check if the tty_context is defined as a securetty
+   Return 0 if secure, < 0 otherwise. */
+        extern int selinux_check_securetty_context(security_context_t
+                                                   tty_context);
-
-/* Set the path to the selinuxfs mount point explicitly.

upstream/selinux/libselinux/man/man3/selinux_binary_policy_path.3

@@ -27 +27 @@
-.br
-extern const char *selinux_media_context_path(void);
+.br
+extern const char *selinux_securetty_types_path(void);
-.br
-extern const char *selinux_contexts_path(void);
@@ -57 +59 @@
-selinux_contexts_path() - directory containing all of the context configuration files
-.sp
+selinux_securetty_types_path() - defines tty types for newrole securettys
+.sp
-selinux_booleans_path() - initial policy boolean settings
-

upstream/selinux/libselinux/src/file_path_suffixes.h

@@ -8 +8 @@
-    S_(FAILSAFE_CONTEXT, "/contexts/failsafe_context")
-    S_(DEFAULT_TYPE, "/contexts/default_type")
+    S_(SECURETTY_TYPES, "/contexts/securetty_types")
-    S_(BOOLEANS, "/booleans")
-    S_(MEDIA_CONTEXTS, "/contexts/files/media")

upstream/selinux/libselinux/src/selinux_config.c

@@ -39 +39 @@
-#define FILE_CONTEXTS_HOMEDIR 16
-#define FILE_CONTEXTS_LOCAL 17
-
+
+
-
-/* New layout is relative to SELINUXDIR/policytype. */
@@ -300 +301 @@
-hidden_def(selinux_default_context_path)
-
+const char *selinux_securetty_types_path()
+{
+        return get_path(SECURETTY_TYPES);
+}
+
+hidden_def(selinux_securetty_types_path)
+
-const char *selinux_failsafe_context_path()
-{

upstream/selinux/libselinux/src/selinux_internal.h

@@ -54 +54 @@
-    hidden_proto(selinux_binary_policy_path)
-    hidden_proto(selinux_default_context_path)
+    hidden_proto(selinux_securetty_types_path)
-    hidden_proto(selinux_failsafe_context_path)
-    hidden_proto(selinux_removable_context_path)
@@ -67 +68 @@
-    hidden_proto(selinux_path)
-    hidden_proto(selinux_check_passwd_access)
+    hidden_proto(selinux_check_securetty_context)
-    hidden_proto(matchpathcon_init_prefix)
-    hidden_proto(selinux_users_path)

upstream/selinux/libselinux/utils/matchpathcon.c

@@ -96 +96 @@
-        }
-        for (i = optind; i < argc; i++) {
-=
+ = 
-                struct stat buf;
-                if (lstat(argv[i], &buf) == 0)
@@ -115 +115 @@
-                                        printf("%s has context %s, should be ",
-                                               argv[i], con);
-
+
+
-                                        freecon(con);
-                                } else {
@@ -121 +122 @@
-                                            ("actual context unknown: %s, should be ",
-                                             strerror(errno));
-
+
+
-                                }
-                        }

upstream/selinux/libsemanage/ChangeLog

@@ +1 @@
+1.9.2 2007-01-08
+        * Merged patch to optionally reduce disk usage by removing 
+          the backup module store and linked policy from Karl MacMillan
+        * Merged patch to correctly propagate return values in libsemanage
+
-1.9.1 2006-11-27
-        * Merged patch to compile wit -fPIC instead of -fpic from
@@ -4 +9 @@
-          limit. Patch changed to include libselinux and libsemanage in
-          addition to libsepol.
+
-1.8 2006-10-17
-        * Updated version for release.

upstream/selinux/libsemanage/VERSION

@@ -1 @@
-1
+2

upstream/selinux/libsemanage/src/conf-parse.y

@@ -57 +57 @@
-}
-
-
+ SAVE_PREVIOUS SAVE_LINKED
-%token LOAD_POLICY_START SETFILES_START GENHOMEDIRCON_START
-%token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START BLOCK_END
@@ -79 +79 @@
-        |       expand_check
-        |       file_mode
+        |       save_previous
+        |       save_linked
-        ;
-
@@ -113 +115 @@
-        ;
-
+save_previous:    SAVE_PREVIOUS '=' ARG {
+                        if (strcasecmp($3, "true") == 0)
+                                current_conf->save_previous = 1;
+                        else if (strcasecmp($3, "false") == 0)
+                                current_conf->save_previous = 0;                
+                        else {
+                                yyerror("save-previous can only be 'true' or 'false'");
+                        }
+                }
+        ;
+
+
+save_linked:    SAVE_LINKED '=' ARG {
+                        if (strcasecmp($3, "true") == 0)
+                                current_conf->save_linked = 1;
+                        else if (strcasecmp($3, "false") == 0)
+                                current_conf->save_linked = 0;          
+                        else {
+                                yyerror("save-linked can only be 'true' or 'false'");
+                        }
+                }
+        ;
+
+
-command_block: 
-                command_start external_opts BLOCK_END  {
@@ -187 +213 @@
-        conf->expand_check = 1;
-        conf->file_mode = 0644;
+
+        conf->save_previous = 0;
+        conf->save_linked = 0;
-
-        if ((conf->load_policy =
@@ -285 +314 @@
-int semanage_error(char *msg)
-{
+        fprintf(stderr, "error parsing semanage configuration file: %s\n", msg);
-        parse_errors++;
-        return 0;

upstream/selinux/libsemanage/src/conf-scan.l

@@ -43 +43 @@
-expand-check      return EXPAND_CHECK;
-file-mode         return FILE_MODE;
+save-previous     return SAVE_PREVIOUS;
+save-linked       return SAVE_LINKED;
-"[load_policy]"   return LOAD_POLICY_START;
-"[setfiles]"      return SETFILES_START;

upstream/selinux/libsemanage/src/direct_api.c

@@ -468 +468 @@
-        /* Before we do anything else, flush the join to its component parts.
-         * This *does not* flush to disk automatically */
-
-
-
+
+
+
+
+
-
-        /* Decide if anything was modified */
@@ -498 +500 @@
-
-                /* link all modules in the sandbox to the base module */
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                }
-
@@ -518 +547 @@
-                /* File Contexts */
-                /* Sort the file contexts. */
-
-
-
-
-
-
+
+
+
+
+
-
-                /* Write the contexts (including template contexts) to a single file.  
-                 * The buffer returned by the sort function has a trailing \0 character,
-                 * which we do NOT want to write out to disk, so we pass sorted_fc_buffer_len-1. */
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-
-                /* Split complete and template file contexts into their separate files. */
-
+
+
-                        goto cleanup;
-
@@ -543 +575 @@
-                /* Seusers */
-                if (sepol_module_package_get_seusers_len(base)) {
-
-
-
-
-
-
-
-
+
+
+
-                                goto cleanup;
-                        }
+                        retval = write_file(sh, ofilename,
+                                            sepol_module_package_get_seusers(base),
+                                            sepol_module_package_get_seusers_len(base));
+                        if (retval < 0)
+                                goto cleanup;
+
-                        pseusers->dtable->drop_cache(pseusers->dbase);
-
-                } else {
-
+
+
-                                goto cleanup;
-                }
@@ -562 +596 @@
-                /* Users_extra */
-                if (sepol_module_package_get_user_extra_len(base)) {
-
-
-
-
-
-
-
-
+
+
+
-                                goto cleanup;
-                        }
+                        retval = write_file(sh, ofilename,
+                                            sepol_module_package_get_user_extra(base),
+                                            sepol_module_package_get_user_extra_len(base));
+                        if (retval < 0)
+                                goto cleanup;
-                        pusers_extra->dtable->drop_cache(pusers_extra->dbase);
-
-                } else {
-if (pusers_extra->dtable->
-    clear(sh, pusers_extra->dbase)
+retval = pusers_extra->dtable->clear(sh, pusers_extra->dbase);
+if (retval
-                                goto cleanup;
-                }
@@ -604 +638 @@
-                /* Create new policy object, then attach to policy databases
-                 * that work with a policydb */
-
+
+
-                        goto cleanup;
-
@@ -616 +651 @@
-                /* ============= Apply changes, and verify  =============== */
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-                        goto cleanup;
-        }
@@ -636 +674 @@
-         * large file_contexts - checked at compile time */
-        if (sh->do_rebuild || modified || fcontexts_modified) {
-
+
+
-                        goto cleanup;
-        }
@@ -642 +681 @@
-        /* Validate local seusers against policy */
-        if (sh->do_rebuild || modified || seusers_modified) {
-
+
+
-                        goto cleanup;
-        }
@@ -648 +688 @@
-        /* Validate local ports for overlap */
-        if (sh->do_rebuild || ports_modified) {
-
+
+
-                        goto cleanup;
-        }
@@ -655 +696 @@
-
-        /* Commit changes to components */
-
+
+
-                goto cleanup;
-

upstream/selinux/libsemanage/src/semanage_conf.h

@@ -36 +36 @@
-        int policyvers;         /* version for server generated policies */
-        int expand_check;
+        int save_previous;
+        int save_linked;
-        mode_t file_mode;
-        struct external_prog *load_policy;

upstream/selinux/libsemanage/src/semanage_store.c

@@ -1225 +1225 @@
-        }
-
+        if (!sh->conf->save_previous) {
+                retval = semanage_remove_directory(backup);
+                if (retval < 0) {
+                        ERR(sh, "Could not delete previous directory %s.", backup);
+                        goto cleanup;
+                }
+        }
+
-      cleanup:
-        semanage_release_active_lock(sh);

upstream/selinux/policycoreutils/ChangeLog

@@ +1 @@
+1.33.12 2007-01-11
+        * Merged newrole securetty check from Dan Walsh.
+        * Merged semodule patch to generalize list support from Karl MacMillan.
+
+1.33.11 2007-01-09
+        * Merged fixfiles and seobject fixes from Dan Walsh.
+        * Merged semodule support for list of modules after -i from Karl MacMillan. 
+
+1.33.10 2007-01-08
+        * Merged patch to correctly handle a failure during semanage handle
+          creation from Karl MacMillan.
+
+1.33.9 2007-01-05
+        * Merged patch to fix seobject role modification from Dan Walsh.
+
-1.33.8 2007-01-04
-        * Merged patches from Dan Walsh to:

upstream/selinux/policycoreutils/VERSION

@@ -1 @@
-8
+12

upstream/selinux/policycoreutils/newrole/newrole.c

@@ -742 +742 @@
-        char *range_ptr = NULL;
-        security_context_t new_con = NULL;
+        security_context_t tty_con = NULL;
-        context_t context = NULL; /* manipulatable form of new_context */
-        const struct option long_options[] = {
@@ -794 +795 @@
-                                return -1;
-                        }
+                        if (fgetfilecon(0,&tty_con) >= 0) {
+                                if (selinux_check_securetty_context(tty_con) < 0) {
+                                        fprintf(stderr, _("Error: you are not allowed to change levels on a non secure terminal\n"));
+                                        freecon(tty_con);
+                                        return -1;
+                                }
+                                freecon(tty_con);
+                        }
+
-                        level_s = optarg;
-                        break;

upstream/selinux/policycoreutils/po/kn.po

@@ -9 +9 @@
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: \n"
-6-10-20 09:14-04
+7-01-11 12:24-05
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
@@ -27 +27 @@
-msgstr ""
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-#, c-format
-msgid "Out of memory!\n"
-msgstr ""
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-#, c-format
-msgid "failed to initialize PAM\n"
-msgstr ""
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-