Changeset 292

Show
Ignore:
Timestamp:
07/11/07 14:45:49 (1 year ago)
Author:
mgoldman
Message:

upstream updated 2007-07-11

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • upstream/selinux/checkpolicy/ChangeLog

    r234 r292  
     12.0.3 2007-05-31 
     2        * Merged fix for segfault on duplicate require of sensitivity from Caleb Case. 
     3        * Merged fix for dead URLs in checkpolicy man pages from Dan Walsh. 
     4 
    152.0.2 2007-04-12 
    26        * Merged checkmodule man page fix from Dan Walsh. 

  • upstream/selinux/checkpolicy/Makefile

    r10 r292  
    5959 
    6060indent: 
    61         ../Lindent $(filter-out $(GENERATED),$(wildcard *.[ch])) 
     61        ../scripts/Lindent $(filter-out $(GENERATED),$(wildcard *.[ch])) 

  • upstream/selinux/checkpolicy/VERSION

    r234 r292  
    1 2.0.2 
     12.0.3 

  • upstream/selinux/checkpolicy/checkmodule.8

    r234 r292  
    4848.SH "SEE ALSO" 
    4949.B semodule(8), semodule_package(8) 
    50 SELinux documentation at http://www.nsa.gov/selinux/docs.html, 
     50SELinux documentation at http://www.nsa.gov/selinux, 
    5151especially "Configuring the SELinux Policy". 
    5252 

  • upstream/selinux/checkpolicy/checkpolicy.8

    r10 r292  
    3535 
    3636.SH "SEE ALSO" 
    37 SELinux documentation at http://www.nsa.gov/selinux/docs.html, 
     37SELinux documentation at http://www.nsa.gov/selinux, 
    3838especially "Configuring the SELinux Policy". 
    3939 

  • upstream/selinux/checkpolicy/module_compiler.c

    r28 r292  
    143143                                                      key); 
    144144                assert(s != NULL); 
    145                 *dest_value = s->value; 
     145                 
     146                if (symbol_type == SYM_LEVELS) { 
     147                        *dest_value = ((level_datum_t *)s)->level->sens; 
     148                } else { 
     149                        *dest_value = s->value; 
     150                } 
    146151        } else if (retval == -2) { 
    147152                return -2; 
    …… 
    497502                                                      key); 
    498503                assert(s != NULL); 
    499                 *dest_value = s->value; 
     504                 
     505                if (symbol_type == SYM_LEVELS) { 
     506                        *dest_value = ((level_datum_t *)s)->level->sens; 
     507                } else { 
     508                        *dest_value = s->value; 
     509                } 
    500510        } else if (retval == -2) { 
    501511                /* ignore require statements if that symbol was 

  • upstream/selinux/libselinux/ChangeLog

    r234 r292  
     12.0.24 2007-09-07 
     2        * Fix for getfilecon() for zero-length contexts from Stephen Smalley. 
     3 
     42.0.23 2007-06-22 
     5        * Refactored SWIG bindings from James Athey. 
     6 
     72.0.22 2007-06-20 
     8        * Labeling and callback interface patches from Eamon Walsh. 
     9 
     102.0.21 2007-06-11 
     11        * Class and permission mapping support patches from Eamon Walsh. 
     12 
     132.0.20 2007-06-07 
     14        * Object class discovery support patches from Chris PeBenito. 
     15 
     162.0.19 2007-06-05 
     17        * Refactoring and errno support in string representation code. 
     18 
     192.0.18 2007-05-31 
     20        * Merged patch to reduce size of libselinux and remove need for libsepol for embedded systems from Yuichi Nakamura. 
     21          This patch also turns the link-time dependency on libsepol into a runtime (dlopen) dependency even in the non-embedded case. 
     22 
     232.0.17 2007-05-31 
     24        * Updated Lindent script and reindented two header files. 
     25 
     262.0.16 2007-05-09 
     27        * Merged additional swig python bindings from Dan Walsh. 
     28 
     292.0.15 2007-04-27 
     30        * Merged helpful message when selinuxfs mount fails patch from Dax Kelson. 
     31 
     322.0.14 2007-04-24 
     33        * Merged build fix for avc_internal.c from Joshua Brindle. 
     34 
    1352.0.13 2007-04-12 
    236        * Merged rpm_execcon python binding fix, matchpathcon man page fix, and getsebool -a handling for EACCES from Dan Walsh. 

  • upstream/selinux/libselinux/Makefile

    r10 r292  
     1DISABLE_AVC ?= n 
     2DISABLE_SETRANS ?= n 
     3DISABLE_RPM ?= n 
     4DISABLE_BOOL ?= n 
     5ifeq ($(EMBEDDED),y) 
     6        override DISABLE_AVC=y 
     7        override DISABLE_SETRANS=y 
     8        override DISABLE_RPM=y 
     9        override DISABLE_BOOL=y 
     10endif 
     11ifeq ($(DISABLE_BOOL),y) 
     12        EMFLAGS+= -DDISABLE_BOOL 
     13endif 
     14ifeq ($(DISABLE_SETRANS),y) 
     15        EMFLAGS+= -DDISABLE_SETRANS 
     16endif 
     17export DISABLE_AVC DISABLE_SETRANS DISABLE_RPM DISABLE_BOOL EMFLAGS 
     18 
    119all:  
    220        $(MAKE) -C src  

  • upstream/selinux/libselinux/VERSION

    r234 r292  
    1 2.0.13 
     12.0.24 

  • upstream/selinux/libselinux/include/Makefile

    r10 r292  
    88 
    99indent: 
    10         ../../Lindent $(wildcard selinux/*.h) 
     10        ../../scripts/Lindent $(wildcard selinux/*.h) 
    1111 

  • upstream/selinux/libselinux/include/selinux/avc.h

    r234 r292  
    1919 * SID format and operations 
    2020 */ 
    21        struct security_id { 
    22                security_context_t ctx; 
    23                unsigned int refcnt; 
    24        }; 
    25        typedef struct security_id *security_id_t; 
     21struct security_id { 
     22        security_context_t ctx; 
     23        unsigned int refcnt; 
     24}; 
     25typedef struct security_id *security_id_t; 
    2626 
    2727#define SECSID_WILD (security_id_t)NULL /* unspecified SID */ 
    …… 
    3838 * available to make the copy, or %EINVAL if the input SID is invalid. 
    3939 */ 
    40        int avc_sid_to_context(security_id_t sid, security_context_t * ctx); 
    41        int avc_sid_to_context_raw(security_id_t sid, security_context_t * ctx); 
     40int avc_sid_to_context(security_id_t sid, security_context_t * ctx); 
     41int avc_sid_to_context_raw(security_id_t sid, security_context_t * ctx); 
    4242 
    4343/** 
    …… 
    5252 * returning %0 on success or -%1 on error with @errno set.   
    5353 */ 
    54        int avc_context_to_sid(security_context_t ctx, security_id_t * sid); 
    55        int avc_context_to_sid_raw(security_context_t ctx, security_id_t * sid); 
     54int avc_context_to_sid(security_context_t ctx, security_id_t * sid); 
     55int avc_context_to_sid_raw(security_context_t ctx, security_id_t * sid); 
    5656 
    5757/** 
    …… 
    6565 * increments reference counts. 
    6666 */ 
    67        int sidget(security_id_t sid); 
     67int sidget(security_id_t sid); 
    6868 
    6969/** 
    …… 
    7777 * be called to obtain a new SID for the security context. 
    7878 */ 
    79        int sidput(security_id_t sid); 
     79int sidput(security_id_t sid); 
    8080 
    8181/** 
    …… 
    8888 * avc_context_to_sid() to get the corresponding SID. 
    8989 */ 
    90        int avc_get_initial_sid(const char * name, security_id_t * sid); 
     90int avc_get_initial_sid(const char *name, security_id_t * sid); 
    9191 
    9292/* 
    9393 * AVC entry 
    9494 */ 
    95        struct avc_entry; 
    96        struct avc_entry_ref { 
    97                struct avc_entry *ae; 
    98        }; 
     95struct avc_entry; 
     96struct avc_entry_ref { 
     97        struct avc_entry *ae; 
     98}; 
    9999 
    100100/** 
    …… 
    120120 * If no locking callbacks are passed, no locking will take place. 
    121121 */ 
    122        struct avc_memory_callback { 
    123                /* malloc() equivalent. */ 
    124                void *(*func_malloc) (size_t size); 
    125                /* free() equivalent. */ 
    126                void (*func_free) (void *ptr); 
    127                /* Note that these functions should set errno on failure. 
    128                   If not, some avc routines may return -1 without errno set. */ 
    129        }; 
    130  
    131        struct avc_log_callback { 
    132                /* log the printf-style format and arguments. */ 
    133                void (*func_log) (const char *fmt, ...); 
    134                /* store a string representation of auditdata (corresponding 
    135                   to the given security class) into msgbuf. */ 
    136                void (*func_audit) (void *auditdata, security_class_t cls, 
    137                                    char *msgbuf, size_t msgbufsize); 
    138        }; 
    139  
    140        struct avc_thread_callback { 
    141                /* create and start a thread, returning an opaque pointer to it;  
    142                   the thread should run the given function. */ 
    143                void *(*func_create_thread) (void (*run) (void)); 
    144                /* cancel a given thread and free its resources. */ 
    145                void (*func_stop_thread) (void *thread); 
    146        }; 
    147  
    148        struct avc_lock_callback { 
    149                /* create a lock and return an opaque pointer to it. */ 
    150                void *(*func_alloc_lock) (void); 
    151                /* obtain a given lock, blocking if necessary. */ 
    152                void (*func_get_lock) (void *lock); 
    153                /* release a given lock. */ 
    154                void (*func_release_lock) (void *lock); 
    155                /* destroy a given lock (free memory, etc.) */ 
    156                void (*func_free_lock) (void *lock); 
    157        }; 
     122struct avc_memory_callback { 
     123        /* malloc() equivalent. */ 
     124        void *(*func_malloc) (size_t size); 
     125        /* free() equivalent. */ 
     126        void (*func_free) (void *ptr); 
     127        /* Note that these functions should set errno on failure. 
     128           If not, some avc routines may return -1 without errno set. */ 
     129}; 
     130 
     131struct avc_log_callback { 
     132        /* log the printf-style format and arguments. */ 
     133        void (*func_log) (const char *fmt, ...); 
     134        /* store a string representation of auditdata (corresponding 
     135           to the given security class) into msgbuf. */ 
     136        void (*func_audit) (void *auditdata, security_class_t cls, 
     137                            char *msgbuf, size_t msgbufsize); 
     138}; 
     139 
     140struct avc_thread_callback { 
     141        /* create and start a thread, returning an opaque pointer to it;  
     142           the thread should run the given function. */ 
     143        void *(*func_create_thread) (void (*run) (void)); 
     144        /* cancel a given thread and free its resources. */ 
     145        void (*func_stop_thread) (void *thread); 
     146}; 
     147 
     148struct avc_lock_callback { 
     149        /* create a lock and return an opaque pointer to it. */ 
     150        void *(*func_alloc_lock) (void); 
     151        /* obtain a given lock, blocking if necessary. */ 
     152        void (*func_get_lock) (void *lock); 
     153        /* release a given lock. */ 
     154        void (*func_release_lock) (void *lock); 
     155        /* destroy a given lock (free memory, etc.) */ 
     156        void (*func_free_lock) (void *lock); 
     157}; 
    158158 
    159159/* 
    …… 
    176176 * structures above). 
    177177 */ 
    178        int avc_init(const char *msgprefix, 
    179                     const struct avc_memory_callback *mem_callbacks, 
    180                     const struct avc_log_callback *log_callbacks, 
    181                     const struct avc_thread_callback *thread_callbacks, 
    182                     const struct avc_lock_callback *lock_callbacks); 
     178int avc_init(const char *msgprefix, 
     179             const struct avc_memory_callback *mem_callbacks, 
     180             const struct avc_log_callback *log_callbacks, 
     181             const struct avc_thread_callback *thread_callbacks, 
     182             const struct avc_lock_callback *lock_callbacks); 
    183183 
    184184/** 
    …… 
    190190 * to return memory to the system. 
    191191 */ 
    192        void avc_cleanup(void); 
     192void avc_cleanup(void); 
    193193 
    194194/** 
    …… 
    200200 * -%1 with @errno set on error. 
    201201 */ 
    202        int avc_reset(void); 
     202int avc_reset(void); 
    203203 
    204204/** 
    …… 
    211211 * User must call avc_init() if further use of AVC is desired. 
    212212 */ 
    213        void avc_destroy(void); 
     213void avc_destroy(void); 
    214214 
    215215/** 
    …… 
    234234 * should be released for the auditing. 
    235235 */ 
    236         int avc_has_perm_noaudit(security_id_t ssid, 
    237                                  security_id_t tsid, 
    238                                  security_class_t tclass, 
    239                                  access_vector_t requested, 
    240                                  struct avc_entry_ref *aeref, 
    241                                  struct av_decision *avd); 
     236int avc_has_perm_noaudit(security_id_t ssid, 
     237                         security_id_t tsid, 
     238                         security_class_t tclass, 
     239                         access_vector_t requested, 
     240                         struct avc_entry_ref *aeref, struct av_decision *avd); 
    242241 
    243242/** 
    …… 
    259258 * are denied or to another value upon other errors. 
    260259 */ 
    261        int avc_has_perm(security_id_t ssid, security_id_t tsid, 
    262                         security_class_t tclass, access_vector_t requested, 
    263                         struct avc_entry_ref *aeref, void *auditdata); 
     260int avc_has_perm(security_id_t ssid, security_id_t tsid, 
     261                security_class_t tclass, access_vector_t requested, 
     262                struct avc_entry_ref *aeref, void *auditdata); 
    264263 
    265264/** 
    …… 
    282281 * before calling the auditing code. 
    283282 */ 
    284        void avc_audit(security_id_t ssid, security_id_t tsid, 
    285                       security_class_t tclass, access_vector_t requested, 
    286                       struct av_decision *avd, int result, void *auditdata); 
     283void avc_audit(security_id_t ssid, security_id_t tsid, 
     284               security_class_t tclass, access_vector_t requested, 
     285               struct av_decision *avd, int result, void *auditdata); 
    287286 
    288287/** 
    …… 
    300299 * error with @errno set.   
    301300 */ 
    302         int avc_compute_create(security_id_t ssid, 
    303                                security_id_t tsid, 
    304                                security_class_t tclass, 
    305                                security_id_t *newsid); 
     301int avc_compute_create(security_id_t ssid, 
     302                       security_id_t tsid, 
     303                       security_class_t tclass, security_id_t * newsid); 
    306304 
    307305/*  
    …… 
    334332 * -%1 if insufficient memory exists to add the callback. 
    335333 */ 
    336        int avc_add_callback(int (*callback) 
    337                              (uint32_t event, security_id_t ssid, 
    338                               security_id_t tsid, security_class_t tclass, 
    339                               access_vector_t perms, 
    340                               access_vector_t * out_retained), 
    341                             uint32_t events, security_id_t ssid, 
    342                             security_id_t tsid, security_class_t tclass, 
    343                             access_vector_t perms); 
     334int avc_add_callback(int (*callback) 
     335                      (uint32_t event, security_id_t ssid, 
     336                       security_id_t tsid, security_class_t tclass, 
     337                       access_vector_t perms, 
     338                       access_vector_t * out_retained), 
     339                     uint32_t events, security_id_t ssid, 
     340                     security_id_t tsid, security_class_t tclass, 
     341                     access_vector_t perms); 
    344342 
    345343/* 
    …… 
    352350#define AVC_CACHE_STATS     1 
    353351 
    354        struct avc_cache_stats { 
    355                unsigned entry_lookups; 
    356                unsigned entry_hits; 
    357                unsigned entry_misses; 
    358                unsigned entry_discards; 
    359                unsigned cav_lookups; 
    360                unsigned cav_hits; 
    361                unsigned cav_probes; 
    362                unsigned cav_misses; 
    363        }; 
     352struct avc_cache_stats { 
     353        unsigned entry_lookups; 
     354        unsigned entry_hits; 
     355        unsigned entry_misses; 
     356        unsigned entry_discards; 
     357        unsigned cav_lookups; 
     358        unsigned cav_hits; 
     359        unsigned cav_probes; 
     360        unsigned cav_misses; 
     361}; 
    364362 
    365363/** 
    …… 
    372370 * details. 
    373371 */ 
    374        void avc_cache_stats(struct avc_cache_stats *stats); 
     372void avc_cache_stats(struct avc_cache_stats *stats); 
    375373 
    376374/** 
    …… 
    381379 * callback is used to print the message. 
    382380 */ 
    383        void avc_av_stats(void); 
     381void avc_av_stats(void); 
    384382 
    385383/** 
    …… 
    390388 * is used to print the message. 
    391389 */ 
    392        void avc_sid_stats(void); 
     390void avc_sid_stats(void); 
    393391 
    394392#ifdef __cplusplus 

  • upstream/selinux/libselinux/include/selinux/selinux.h

    r234 r292  
    1010 
    1111/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */ 
    12        extern int is_selinux_enabled(void); 
     12extern int is_selinux_enabled(void); 
    1313/* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */ 
    14        extern int is_selinux_mls_enabled(void); 
    15  
    16        typedef char *security_context_t; 
     14extern int is_selinux_mls_enabled(void); 
     15 
     16typedef char *security_context_t; 
    1717 
    1818/* Free the memory allocated for a context by any of the below get* calls. */ 
    19        extern void freecon(security_context_t con); 
     19extern void freecon(security_context_t con); 
    2020 
    2121/* Free the memory allocated for a context array by security_compute_user. */ 
    22        extern void freeconary(security_context_t * con); 
     22extern void freeconary(security_context_t * con); 
    2323 
    2424/* Wrappers for the /proc/pid/attr API. */ 
    …… 
    2626/* Get current context, and set *con to refer to it. 
    2727   Caller must free via freecon. */ 
    28        extern int getcon(security_context_t * con); 
    29        extern int getcon_raw(security_context_t * con); 
     28extern int getcon(security_context_t * con); 
     29extern int getcon_raw(security_context_t * con); 
    3030 
    3131/* Set the current security context to con.   
    …… 
    3737   as a result of a setcon() unless policy allows it to use descriptors opened 
    3838   by the old context. */ 
    39        extern int setcon(security_context_t con); 
    40        extern int setcon_raw(security_context_t con); 
     39extern int setcon(security_context_t con); 
     40extern int setcon_raw(security_context_t con); 
    4141 
    4242/* Get context of process identified by pid, and  
    4343   set *con to refer to it.  Caller must free via freecon. */ 
    44        extern int getpidcon(pid_t pid, security_context_t * con); 
    45        extern int getpidcon_raw(pid_t pid, security_context_t * con); 
     44extern int getpidcon(pid_t pid, security_context_t * con); 
     45extern int getpidcon_raw(pid_t pid, security_context_t * con); 
    4646 
    4747/* Get previous context (prior to last exec), and set *con to refer to it. 
    4848   Caller must free via freecon. */ 
    49        extern int getprevcon(security_context_t * con); 
    50        extern int getprevcon_raw(security_context_t * con); 
     49extern int getprevcon(security_context_t * con); 
     50extern int getprevcon_raw(security_context_t * con); 
    5151 
    5252/* Get exec context, and set *con to refer to it. 
    5353   Sets *con to NULL if no exec context has been set, i.e. using default. 
    5454   If non-NULL, caller must free via freecon. */ 
    55        extern int getexeccon(security_context_t * con); 
    56        extern int getexeccon_raw(security_context_t * con); 
     55extern int getexeccon(security_context_t * con); 
     56extern int getexeccon_raw(security_context_t * con); 
    5757 
    5858/* Set exec security context for the next execve.  
    5959   Call with NULL if you want to reset to the default. */ 
    60        extern int setexeccon(security_context_t con); 
    61        extern int setexeccon_raw(security_context_t con); 
     60extern int setexeccon(security_context_t con); 
     61extern int setexeccon_raw(security_context_t con); 
    6262 
    6363/* Get fscreate context, and set *con to refer to it. 
    6464   Sets *con to NULL if no fs create context has been set, i.e. using default. 
    6565   If non-NULL, caller must free via freecon. */ 
    66        extern int getfscreatecon(security_context_t * con); 
    67        extern int getfscreatecon_raw(security_context_t * con); 
     66extern int getfscreatecon(security_context_t * con); 
     67extern int getfscreatecon_raw(security_context_t * con); 
    6868 
    6969/* Set the fscreate security context for subsequent file creations. 
    7070   Call with NULL if you want to reset to the default. */ 
    71        extern int setfscreatecon(security_context_t context); 
    72        extern int setfscreatecon_raw(security_context_t context); 
     71extern int setfscreatecon(security_context_t context); 
     72extern int setfscreatecon_raw(security_context_t context); 
    7373 
    7474/* Get keycreate context, and set *con to refer to it. 
    7575   Sets *con to NULL if no key create context has been set, i.e. using default. 
    7676   If non-NULL, caller must free via freecon. */ 
    77        extern int getkeycreatecon(security_context_t * con); 
    78        extern int getkeycreatecon_raw(security_context_t * con); 
     77extern int getkeycreatecon(security_context_t * con); 
     78extern int getkeycreatecon_raw(security_context_t * con); 
    7979 
    8080/* Set the keycreate security context for subsequent key creations. 
    8181   Call with NULL if you want to reset to the default. */ 
    82        extern int setkeycreatecon(security_context_t context); 
    83        extern int setkeycreatecon_raw(security_context_t context); 
     82extern int setkeycreatecon(security_context_t context); 
     83extern int setkeycreatecon_raw(security_context_t context); 
    8484 
    8585/* Get sockcreate context, and set *con to refer to it. 
    8686   Sets *con to NULL if no socket create context has been set, i.e. using default. 
    8787   If non-NULL, caller must free via freecon. */ 
    88        extern int getsockcreatecon(security_context_t * con); 
    89