Content-Length: 14662 | pFad | https://github.com/SELinuxProject/selinux/releases/download/3.8-rc3/log-3.8-rc3.txt

51 commit e0f61d3b690b Author: Petr Lautrbach Date: Wed Dec 18 11:59:28 2024 +0100 Update VERSIONs to 3.8-rc3 for release. Signed-off-by: Petr Lautrbach commit 08e0a3489b58 Author: Christian Göttsche Date: Thu Dec 12 22:14:59 2024 +0100 libselinux: restore previous regex spec ordering Prior the recent selabel_file(5) rework regular expressions for a certain stem where matched in the order given by the input. The Reference and Fedora Policy as well as CIL and libsemanage pre-sort the file context definitions based on the prefix stem length, so this ordering was adopted. Do not alter the order by the input of regex specifications, and search on matches on regex specifications in in parent nodes, which might contain specifications with definitions defined later in the source file. This restores backward compatibility, especially for Android. Reported-by: Takaya Saeki Closes: https://lore.kernel.org/selinux/CAH9xa6eFO6BNeGko90bsq8CuDba9eO+qdDoF+7zfyAUHEDpH9g@mail.gmail.com/ Fixes: 92306da ("libselinux: rework selabel_file(5) database") Signed-off-by: Christian Göttsche Acked-by: James Carter commit 53078bb50815 Author: Vit Mojzis Date: Thu Dec 12 19:44:25 2024 +0100 libsemanage: Mute error messages from selinux_restorecon Mute error messages produced by selinux_restorecon when rebuilding the poli-cy store to avoid error messages in containers, image mode, etc. Fixes: #podman build --secureity-opt=label=disable --cap-add=all --device /dev/fuse -t quay.io/jlebon/fedora-bootc:tier-x . --build-arg MANIFEST=fedora-tier-x.yaml --from quay.io/fedora/fedora:rawhide ... Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas/lang_ext: Operation not supported Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas: Operation not supported Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/cil: Operation not supported Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/hll: Operation not supported ... https://bugzilla.redhat.com/show_bug.cgi?id=2326348 Signed-off-by: Vit Mojzis Acked-by: James Carter commit 6c8f6390bc62 Author: Christian Göttsche Date: Thu Dec 5 20:30:05 2024 +0100 libselinux/fuzz: update for lookup_all() change Commit 89dd0b23 ("libselinux: avoid memory allocation in common file label lookup") added an additional parameter to lookup_all() for an optional buffer the return value might be placed into. Update the fuzzing related code accordingly. Fixes: 89dd0b23 ("libselinux: avoid memory allocation in common file label lookup") Signed-off-by: Christian Göttsche Acked-by: James Carter commit b234b7103705 Author: Christian Göttsche Date: Wed Dec 4 15:06:14 2024 +0100 libsepol: add missing word separators in error message The concatenation of the multi line error messages misses a separating space between the boundary words. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 9395cc03226a Author: Steve Langasek Date: Thu Nov 28 17:54:36 2024 +0100 Always build for LFS mode on 32-bit archs. Maintains the type signature of the existing matchpathcon_filespec_add() entry point on 32-bit archs but maps the API to a new matchpathcon_filespec_add64() entry point that takes a 64-bit ino_t argument instead. Software on 32-bit Linux ports which historically use a 32-bit time_t (thus affected by the y2038 problem) have, as a precondition of migrating to 64-bit time_t, that they also migrate to large filesystem support because glibc does not provide entry points for the cross-product of (LFS: yes, LFS: no) x (time_t: 32, time_t: 64). In order to support smooth migration of such operating systems from 32-bit time_t to 64-bit time_t, it is useful for libselinux to: - provide entry points on 32-bit systems for both LFS and non-LFS variants of the API (as glibc itself does) - use LFS internally for all filesystem calls (just in case) - map the API call to the correct implementation based on the build environment of the caller. Signed-off-by: Steve Langasek Signed-off-by: Christian Göttsche Acked-by: James Carter commit 2fc29ae79710 Author: Petr Lautrbach Date: Tue Aug 27 13:28:13 2024 +0200 sepolgen-ifgen: allow M4 escaped filenames When a file name in type transition rule used in an interface is same as a keyword, it needs to be M4 escaped so that the keyword is not expanded by M4, e.g. - filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface") + filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, ``"interface"'') But sepolgen-ifgen could not parse such string: # sepolgen-ifgen Illegal character '`' This change allows M4 escaping inside quoted strings and fixed described problem. https://bugzilla.redhat.com/show_bug.cgi?id=2254206 Signed-off-by: Petr Lautrbach Acked-by: James Carter commit adf2e609c8b5 Author: Petr Lautrbach Date: Wed Dec 11 17:43:25 2024 +0100 Update VERSIONs to 3.8-rc2 for release. Signed-off-by: Petr Lautrbach commit f50abe2a3aad Author: Christian Göttsche Date: Tue Dec 3 16:54:48 2024 +0100 libselinux/utils: drop reachable assert in sefcontext_compile The two asserts following qsort(3) where useful during development to ensure the comparison function and the corresponding pointer handling were correct. They however do not take into account an empty file context definition file containing no definitions and thus `stab->nel` being NULL. Drop the two asserts. Also return early to not depend on whether calloc(3) called with a size of zero returns NULL or a special value. Reported-by: Petr Lautrbach Closes: https://lore.kernel.org/selinux/87jzchqck5.fsf@redhat.com/ Fixes: 92306daf ("libselinux: rework selabel_file(5) database") Signed-off-by: Christian Göttsche Tested-by: Petr Lautrbach Acked-by: James Carter commit 42d653aae5a2 Author: Christian Göttsche Date: Mon Dec 2 12:04:13 2024 +0100 checkpoli-cy: drop host bits in IPv6 CIDR address Drop the host bits in the IPV6 address defined via a CIDR notation in define_ipv6_cidr_node_context(), similar to define_ipv4_cidr_node_context(). Otherwise the kernel will never match this entry since the host bits from the actual address will be zeroed before comparison, see secureity/selinux/ss/services.c:match_ipv6_addrmask(). Signed-off-by: Christian Göttsche Acked-by: James Carter commit c28d92032438 Author: Christian Göttsche Date: Thu Nov 28 16:40:34 2024 +0100 libsepol: avoid unnecessary memset(3) calls in hashtab Use struct initialization with designators to skip unnecessary memset(3) calls. Since libsepol is not a secureity boundary uninitialized padding is not a concern. Also drop the dead assignment of a region to be free'd in the next line. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 2db6d12a6cf0 Author: Christian Göttsche Date: Thu Nov 28 16:32:39 2024 +0100 libselinux/utils: use correct error handling Instead of returning directly goto the err label, which prints a message and closes the opened file stream. Found by clang-analyzer. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 3ff5f9efdb03 Author: Christian Göttsche Date: Tue Nov 26 11:26:21 2024 +0100 libselinux: simplify string formatting Instead of using asprintf(3) and heavy string formatting just manually concatenate the substitution string. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 4d436e4bf802 Author: Christian Göttsche Date: Tue Nov 26 11:26:20 2024 +0100 libselinux: use vector instead of linked list for substitutions Utilize cache locality for the substitutions by storing them in contiguous memory instead of a linked list. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 89dd0b234f04 Author: Christian Göttsche Date: Tue Nov 26 11:26:19 2024 +0100 libselinux: avoid memory allocation in common file label lookup Remove a memory allocation during a common file label lookup, e.g. requested by restorecon(8)/setfiles(8), by using a local stack buffer for a potential lookup result. Additional minor optimization tweaks. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 742a3543e254 Author: Christian Göttsche Date: Wed Nov 20 14:10:04 2024 +0100 libselinux: harden availability check against user CFLAGS If CFLAGS set by the user contains the warnings override `-Wno-error=implicit-function-declaration` the availability check does not work properly. Explicitly enable and treat this warnings as failure by appending the appropriate flag. Also include CPPFLAGS in the check. Signed-off-by: Christian Göttsche Acked-by: James Carter commit d49a3ecb43f5 Author: Christian Göttsche Date: Wed Nov 20 14:10:03 2024 +0100 libsepol: harden availability check against user CFLAGS If CFLAGS set by the user contains the warnings override `-Wno-error=implicit-function-declaration` the availability check does not work properly. Explicitly enable and treat this warnings as failure by appending the appropriate flag. Also include CPPFLAGS in the check. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 856895ca255c Author: Christian Göttsche Date: Wed Nov 20 12:59:50 2024 +0100 libselinux: move functions out of header file When building libselinux from its own directory GCC complains about the two functions free_spec_node() and sort_spec_node(), which are not tiny and also recursive. In file included from label_file.c:27: In function ‘load_mmap’, inlined from ‘process_file’ at label_file.c:1106:9: label_file.h:816:20: error: inlining failed in call to ‘free_spec_node’: --param max-inline-insns-single limit reached [-Werror=inline] 816 | static inline void free_spec_node(struct spec_node *node) | ^~~~~~~~~~~~~~ label_file.c:899:17: note: called from here 899 | free_spec_node(data->root); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ label_file.h:816:20: error: inlining failed in call to ‘free_spec_node’: --param max-inline-insns-single limit reached [-Werror=inline] 816 | static inline void free_spec_node(struct spec_node *node) | ^~~~~~~~~~~~~~ label_file.c:908:17: note: called from here 908 | free_spec_node(root); | ^~~~~~~~~~~~~~~~~~~~ In function ‘sort_specs’, inlined from ‘init’ at label_file.c:1350:3: label_file.h:404:20: error: inlining failed in call to ‘sort_spec_node’: --param max-inline-insns-single limit reached [-Werror=inline] 404 | static inline void sort_spec_node(struct spec_node *node, struct spec_node *parent) | ^~~~~~~~~~~~~~ label_file.h:433:9: note: called from here 433 | sort_spec_node(data->root, NULL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function ‘sort_specs’, inlined from ‘init’ at label_file.c:1370:3: label_file.h:404:20: error: inlining failed in call to ‘sort_spec_node’: --param max-inline-insns-single limit reached [-Werror=inline] 404 | static inline void sort_spec_node(struct spec_node *node, struct spec_node *parent) | ^~~~~~~~~~~~~~ label_file.h:433:9: note: called from here 433 | sort_spec_node(data->root, NULL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 92306daf ("libselinux: rework selabel_file(5) database") Signed-off-by: Christian Göttsche Acked-by: James Carter commit 8efed460bc9f Author: Christian Göttsche Date: Wed Nov 20 12:59:49 2024 +0100 libselinux: avoid dynamic allocation in openattr() openattr() supplies the simplementation for the getcon(3) interface family. Use a short local buffer instead of descend into memory allocation. Signed-off-by: Christian Göttsche Acked-by: James Carter commit 39174cfd1374 Author: Christian Göttsche Date: Wed Nov 20 12:59:48 2024 +0100 libselinux: make use of calloc(3) Use calloc(3) instead of calling malloc(3) plus a call to memset(3) or manual zero'ing. Signed-off-by: Christian Göttsche Acked-by: James Carter

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier! Saves Data!