make test in sepolgen was broken because checkmodule now requires
the module name to match the file name. Fix it.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1319338
$ sepolgen-ifgen
/usr/share/selinux/devel/include/contrib/docker.if: Syntax error on line 503 docker_t [type=IDENTIFIER]
/usr/share/selinux/devel/include/roles/unconfineduser.if: Syntax error on line 706 unconfined_t [type=IDENTIFIER]
Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
Some refpolicy interfaces use:
* "$" character in paths, for example in kernel/selinux.if:
genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0)
* empty members in ifelse statement, for example in system/init.if:
ifelse(`$5',`',`',`
...
')
Modify sepolgen/refparser grammar accordingly.
This fixes the following syntax errors reported by sepolgen-ifgen:
/usr/share/selinux/refpolicy/include/kernel/selinux.if: Syntax error
on line 43 gen_context [type=GEN_CONTEXT]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 1416 ' [type=SQUOTE]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 1422 ' [type=SQUOTE]
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Since Python 3.3, dictionary hashes are randomized and iterating over
them is no longer deterministic. This makes it difficult to compare
outputs of sepolgen-ifgen command.
Make sepolgen-ifgen deterministic again with Python>=3.3 by always
sorting the dictonaries and sets which are used to produce output.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
In Py3.0, the cmp parameter in sort() function was removed and key keyword is
available since Py2.4.
Fixes: # cat avc.log | audit2allow -R
Traceback (most recent call last):
File "/usr/bin/audit2allow", line 363, in <module>
app.main()
File "/usr/bin/audit2allow", line 351, in main
self.__output()
File "/usr/bin/audit2allow", line 308, in __output
g.set_gen_refpol(ifs, perm_maps)
File "/usr/lib64/python3.4/site-packages/sepolgen/policygen.py", line 101, in set_gen_refpol
self.ifgen = InterfaceGenerator(if_set, perm_maps)
File "/usr/lib64/python3.4/site-packages/sepolgen/policygen.py", line 353, in __init__
self.hack_check_ifs(ifs)
File "/usr/lib64/python3.4/site-packages/sepolgen/policygen.py", line 365, in hack_check_ifs
params.sort(param_comp)
TypeError: must use keyword argument for key function
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
When running sepolgen-ifgen on refpolicy (git master branch), the
following messages show up:
/usr/share/selinux/refpolicy/include/kernel/selinux.if: Syntax error
on line 3369 gen_context [type=GEN_CONTEXT]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 188379 ' [type=SQUOTE]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 188385 ' [type=SQUOTE]
The line numbers are incorrect because the lineno member of the lexer
object is not resetted after each file has been processed. After fixing
this, the messages are nicer:
/usr/share/selinux/refpolicy/include/kernel/selinux.if: Syntax error
on line 43 gen_context [type=GEN_CONTEXT]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 1416 ' [type=SQUOTE]
/usr/share/selinux/refpolicy/include/system/init.if: Syntax error on
line 1422 ' [type=SQUOTE]
As line 43 of kernel/selinux.if contains a genfscon statement with a
gen_context component, the reported line numbers are now correct.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
In python3 it is needed to pass compare function as a key argument
instead of directly passing compare function to sort function
Signed-off-by: Robert Kuska <rkuska@redhat.com>
In Python3 output from Popen communicate function
returns bytes, to handle output as a string it is needed
to properly decode it.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
Constraint rules in output need to be commented in order to make a policy
compilable.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1155974
Patch-by: Miroslav Grepl <mgrepl@redhat.com>
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
By default in Python3 hash uses random seed as salt, this leads to
different order in output from functions which rely on hash as are
dicts and sets. Tests in sepolgen relied on the frozen order.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
Replace usage of print statement with print function.
Use `in` instead of `has_key` when checking for key in dict.
When using `raise` add text (if any) as parameter of exception function.
Add Python3 imports of moved modules.
Replace `map` with list comprehension.
Use reserved word `as` in try-except when catching exception.
Replace `ifilter` function with `filter`.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
xrange function is gone in Python3 and instead range is
xrange by default. Also it doesnt seem to be important
to have xrange used in tests on Python2.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
In Python3 all strings are by default Unicode and both Unicode and String
types are removed from types module. We introduce separate
variables `bytes_type` and `string_type` to reflect Python3 understanding
of strings, on Python2 `bytes_type` refers to <str> and `string_type` to
<unicode>, on Python3 `bytes_type` are <bytes> and `string_type` <str>.
As all strings are Unicodes by default on Python3 we encode them to
bytes when needed as late as possible.
Also other attributes were replaced with their equivalents from
builtins which are available for both Python3 and Python2.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
In Python3 the __cmp__ function is removed, and rich
comparison should be used instead.
Also the cmp function is gone in Python3 therefore it is
reimplemented in util.py and used if running on Python3.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
sha256 hash operates with bytes and in Python3 all strings are unicode
by default, we must encode the data before hashing to ensure they
are bytes in Python3
Signed-off-by: Robert Kuska <rkuska@redhat.com>
Since Python 2.4 .sort() as well as the new sorted() function
take a key parameter which should be a function that returns
a sorting key.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
In Python 3, special function attributes have been
renamed for consistency with other attributes.
__code__ attribute is also present in py2.7 and py2.6
Signed-off-by: Robert Kuska <rkuska@redhat.com>
Python 3 changes the syntax for imports from within a package,
requiring you to use the relative import syntax,
saying from . import mymodule instead of the just import mymodule.
Signed-off-by: Robert Kuska <rkuska@redhat.com>
In Xen on ARM, device tree nodes identified by a path (string) need to
be labeled by the security policy.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
This fixes the build with "make PYTHON=python2" on systems where python
is python3.
For PYLIBVER and PYTHONLIBDIR definitions, I tested Python 2.5, 2.6, 2.7,
3.3 and 3.4. For each of them, these commands print the expected result:
python -c 'import sys;print("python%d.%d" % sys.version_info[0:2])'"
python -c "from distutils.sysconfig import *;print(get_python_lib(1))"
Acked-by: Steve Lawrence <slawrence@tresys.com>
The addition of this rule caused interface vectors to be less accurate.
The grammar looks correct without the rule, so remove it.
Reverted hunk from commit 17cc87e56b
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
