Commit Graph

54 Commits

Author SHA1 Message Date
Stephen Smalley 20c9b4971e Update VERSION files to 2.8-rc3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-05-10 11:08:22 -04:00
Stephen Smalley dc03bae194 Update VERSION files to 2.8-rc2.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-04-26 13:20:40 -04:00
Stephen Smalley f04d64012a Update VERSION files to 2.8-rc1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-04-19 10:40:16 -04:00
Richard Haines via Selinux cf0ab12414 selinux: Add support for the SCTP portcon keyword
Update libsepol, checkpolicy and the CIL compiler to support the SCTP
portcon keyword.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2018-03-19 12:34:29 -04:00
Yuli Khodorkovskiy 733b8005d8 secilc: Fix documentation build for OS X systems
Since Darwin systems do not have GNU sed installed, the Darwin sed is
missing the "regexp-extended" flag needed to modify the secilc markdown
files before processing with pandoc.

A quick fix for Mac users is to `brew install gnu-sed` and to use gsed.

Signed-off-by: Yuli Khodorkovskiy <ykhodo@gmail.com>
2018-02-26 09:55:27 -05:00
Dominick Grift 4b27d5a365 Describe multiple-decls in secilc.8.xml
Signed-off-by: Dominick Grift <dac.override@gmail.com>
2018-02-21 23:06:19 +01:00
Marcus Folkesson b10ed68cf2 secilc: build: follow standard semantics for DESTDIR and PREFIX
Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
2018-02-14 20:02:03 +01:00
Dan Cashman fafe4c212b libsepol: cil: Add ability to redeclare types[attributes]
Modify cil_gen_node() to check to see if the cil_db supports multiple
declarations, and if so, to check whether or not the
repeated symbol is eligible to share the existing, already-stored datum. The
only types considered so far are CIL_TYPE and CIL_TYPEATTRIBUTE, both of
which intall empty datums during AST building, so they automatically return
true.

Test: Build policy with multilpe type and attribute declarations, and
without. Policies are binary-identical.

Signed-off-by: Dan Cashman <dcashman@android.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2017-08-31 14:42:25 -04:00
Grégoire Colbert f77ad59b46 Fixed bad reference in roleattribute
"roleattribute" was referencing "typeattributeset", but I believe it should be referencing "roleattributeset" instead.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2017-08-17 13:05:43 -04:00
Stephen Smalley 1bac758bf6 Update VERSION files for 2.7 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-08-04 09:31:00 -04:00
Stephen Smalley dfda6a5b2c Update VERSION files for 2.7-rc6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-07-28 15:43:47 -04:00
Stephen Smalley 9f1730fa39 Update VERSION files for 2.7-rc5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-07-18 12:01:26 -04:00
Stephen Smalley 83fbc0979d Update VERSION files for 2.7-rc4 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-30 13:41:33 -04:00
Stephen Smalley 6fab7923ce Update VERSION files for 2.7-rc3 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-23 13:01:45 -04:00
Jason Zaman 15f2740733 Makefiles: override *FLAGS and *LIBS
There were several places in the makefiles where LDLIBS or CFLAGS were
supposed to include options to build. They were missing the override
keyword so would be skipped if these vars were set on the make cmdline.
Add the override directive to fix this.

Signed-off-by: Jason Zaman <jason@perfinion.com>
2017-06-20 12:15:04 -04:00
Stephen Smalley 08d4b030ea Update VERSION files for 2.7-rc2 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-16 12:50:03 -04:00
Richard Haines 9ddfb4d544 secilc: Update test policy and documentation for Infiniband
CIL updates to support the InfiniBand development.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2017-06-12 11:13:31 -04:00
Stephen Smalley 2f602f6cb9 Update VERSION files for 2.7-rc1 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-09 10:36:06 -04:00
Jason Zaman fcb5d5cc72 Makefiles: drop -L/-I to system paths
The toolchain automatically handles them and they break cross compiling.

LDFLAGS should also come before object files, some flags (eg,
-Wl,as-needed) can break things if they are in the wrong place)

Gentoo-Bug: https://bugs.gentoo.org/500674

Signed-off-by: Jason Zaman <jason@perfinion.com>
2017-04-25 08:27:05 -04:00
James Carter ea175157dd secilc: Add options to control the expansion of attributes
Added "-G, --expand_generated" option to specify that all automatically
generated attributes should be expanded and removed.

Added "-X, --expand_size <SIZE>" option to specify which attributes
are expanded when building a kernel policy. All attributes that have
less types assigned to it than SIZE will be expanded when writing AV
rules.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2017-04-12 14:33:55 -04:00
Nicolas Iooss 840a7c9180 secilc: add noreturn attribute to usage()
While at it, make usage() static and mark its argument as const.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2017-03-07 14:00:30 -05:00
James Carter 93e677d830 secilc: Add secil2conf which creates a policy.conf from CIL policy
The program secil2conf uses the libsepol function
cil_write_policy_conf() to create a policy.conf file from CIL policy.

By default a file called "policy.conf" will be created, but the "-o"
option can be used to write to a different file. The "-M" option can
be used to override the mls statement in CIL. The "-P" option will
cause tunables to be treated as booleans.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-11-30 10:18:19 -05:00
Stephen Smalley 7935dee8f6 Drop ChangeLog files
They can be generated as desired via git log.
No need to keep maintaining them by hand.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-16 12:10:58 -05:00
Stephen Smalley f1db7b75e0 Updated secilc ChangeLog
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-15 11:10:21 -05:00
Nicolas Iooss 672f96f012 secilc: do not build secilc man page if it is up to date
When running "make all" several times in the root directory of the
project, the following lines always appear (and the command takes some
seconds to complete on my system with a slow hard drive):

    xmlto man secilc.8.xml
    Note: Writing secilc.8

This is because "make man" always builds secilc.8 even though
secilc.8.xml has not been modified. Introduce an intermediate target to
avoid this behavior.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2016-11-15 11:08:50 -05:00
Stephen Smalley b4cca24240 Update VERSION and ChangeLog files for 2.6 final release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-10-14 11:31:26 -04:00
Stephen Smalley 4257778f18 Update VERSION and ChangeLog files for 2.6-rc2 release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-10-06 10:23:40 -04:00
Stephen Smalley 0cea223d33 Update VERSION and ChangeLog files for 2.6-rc1 release.
Intentionally jumping versions in sepolgen to make it consistent
with the rest.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-09-30 12:15:08 -04:00
Stephen Smalley 091de57ec2 Updated ChangeLogs
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-09-30 08:35:22 -04:00
bowgotsai 86b71ed3a3 secilc: correct include path of cil.h for Android
The original CL in AOSP tree:
  https://android-review.googlesource.com/#/c/274894

BUG=31366888
2016-09-30 08:33:21 -04:00
bowgotsai 9bd073afc6 Remove Android.mk files and only keep them in Android tree
The corresponding repository in Android tree:
  https://android.googlesource.com/platform/external/selinux/
2016-09-30 08:32:55 -04:00
Stephen Smalley bedef7d124 libsepol,checkpolicy,secilc: Replace #ifdef DARWIN with __APPLE__.
As per discussion in https://android-review.googlesource.com/#/c/221980,
we should be using #ifdef __APPLE__ rather than our own custom-defined
DARWIN for building on MacOS X.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-05-03 11:54:20 -04:00
James Carter a421da29eb Updated checkpolicy, libselinux, and secilc ChangeLogs.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-04-06 11:24:56 -04:00
Richard Haines 3895fbbe0c selinux: Add support for portcon dccp protocol
This adds CIL and checkpolicy support for the (portcon dccp ...)
statement. The kernel already handles name_bind and name_connect
permissions for the dccp_socket class.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-04-06 10:14:27 -04:00
Steve Lawrence 2b69984b0c Update ChangeLog and VERSION for final release
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2016-02-23 11:31:41 -05:00
Steve Lawrence 3e558a7d1b secilc: update dependency information and man page creation
- Update libsepol dependency to 2.5
- Update Makefile to build the man page when just running 'make'

https://marc.info/?l=selinux&m=145220517200709&w=2

Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2016-01-08 09:38:40 -05:00
Steve Lawrence b3b5ede9ca Update ChangeLog and VERSION for release candidate
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2016-01-07 10:01:31 -05:00
James Carter 59ed638c6d Updated secilc ChangeLog.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-12-16 09:51:38 -05:00
Yuli Khodorkovskiy 12c7dfc553 secilc/docs: Convert DocBook documentation into github markdown
Converting to github markdown allows for easier integration with the
SELinux project wiki and viewing of documentation directly on github without
creating PDFs or reading through DocBook XML.

The conversion of DocBook to github markdown would not format tables or
keyword links properly. By maintaining the documentation in github
markdown in the repository, the content is well formatted with a table of
contents when viewing in the github wiki or in the repository.

The migration from DocBook to github markdown was done using Pandoc and
manual fixups. Mappings of CIL keywords to headings that were lost in the DocBook
conversion were added back. An introduction and design philosphy was
also pulled from the SELinux project wiki to provide more cohesion
to the current documentation.

Running make will now convert the github markdown into PDF and HTML.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
2015-12-15 16:18:34 -05:00
James Carter a2a3c6d03f Updated libsepol and secilc ChangeLogs
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-12-02 15:18:25 -05:00
Steve Lawrence 0013416550 secilc/docs: Add documentation for neverallowx rules
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2015-12-02 15:15:22 -05:00
Yuli Khodorkovskiy 71dd7b7133 secilc: Add support for unordered classes
Resolves https://github.com/SELinuxProject/cil/issues/3

An 'unordered' keyword provides the ability to append classes to the current
list of ordered classes. This allows users to not need knowledge of existing
classes when creating a class and fixes dependencies on classes when removing a
module. This enables userspace object managers with custom objects to be
modularized.

If a class is declared in both an unordered and ordered statement, then the
ordered statement will supercede the unordered declaration.

Example usage:

    ; Appends new_class to the existing list of classes
    (class new_class ())
    (classorder (unordered new_class))

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-11-10 13:26:52 -05:00
Yuli Khodorkovskiy 77779d2ca5 libsepol/cil: Add userattribute{set} functionality
This adds a userattribute statement that may be used in userroles and
constraints. The syntax is the same as typeattributset.

Also, disallow roleattributes where roles are accepted in contexts.

Specify a userattribute

    (userattribute foo)

Add users to the set foo

    (userattributeset foo (u1 u2))

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-09-11 09:07:46 -04:00
Steve Lawrence fbcc08ab2a Updated libselinux and secilc ChangeLog.
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2015-09-02 16:05:56 -04:00
Steve Lawrence 46f32deae2 secilc: Add documentation/examples for allowx, auditallowx, dontauditx, and permissionx
Also removes *bounds statements in policy.cil, which had bounds
violations and are better tested in other test files.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Acked-by: James Carter <jwcart2@tycho.nsa.gov>
2015-09-02 16:03:26 -04:00
James Carter b11ffdd290 Updated libsepol and secilc ChangeLogs.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-06-22 10:04:26 -04:00
James Carter ce5472845b secilc: Add a CIL policy file to test bounds checking.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-06-22 10:03:16 -04:00
James Carter 0e05890e3d secilc: Add a CIL policy file to test neverallow checking.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2015-06-22 10:03:16 -04:00
Stephen Smalley 1af0ed6f13 Update checkpolicy and secilc ChangeLogs.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-15 09:17:16 -04:00
Dan Albert 1f75792ea0 Remove uses of -Wno-return-type.
These warnings were fixed in 93b2e5f.
2015-06-15 09:14:10 -04:00