Commit Graph

2516 Commits

Author SHA1 Message Date
Petr Lautrbach
ee1809f453 Update VERSIONs to 2.9-rc2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-03-01 13:58:20 +01:00
Stephen Smalley
c19395d722 libselinux: selinux_set_mapping: fix handling of unknown classes/perms
The libselinux selinux_set_mapping() implementation was never updated
to handle unknown classes/permissions based on the policy handle_unknown
flag.  Update it and the internal mapping functions to gracefully
handle unknown classes/permissions.  Add a security_reject_unknown()
interface to expose the corresponding selinuxfs node and use it when
creating a mapping to decide whether to fail immediately or proceed.

This enables dbus-daemon and XSELinux, which use selinux_set_mapping(),
to continue working with the dummy policy or other policies that lack
their userspace class/permission definitions as long as the policy
was built with -U allow.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2019-03-01 12:51:31 +01:00
Petr Lautrbach
478c745d82 README: Update Fedora python 3 dependencies
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-20 16:43:27 +01:00
Petr Lautrbach
1952be65dc Switch to python3 by default
- Python 2.7 is planned to be the last of the 2.x releases
- It's generally advised to use Python 3
- Majority of python/ scripts are already switched python3
- Users with python 2 only can still use:

$ make PYTHON=/usr/bin/python ....

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-20 16:43:27 +01:00
Petr Lautrbach
3b868abd2e Always use /usr/bin/python3 in Python scripts
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-20 16:43:27 +01:00
Stephen Smalley
6b89b1f9c1 libselinux: fix selinux_restorecon() on non-SELinux hosts
The kernel only supports seclabel if it is >= 2.6.30 _and_
SELinux is enabled, since seclabel is generated by SELinux
based partly on policy (e.g. is the filesystem type configured in policy
with a labeling behavior that supports userspace labeling). For some
reason, when this logic was moved from setfiles to libselinux,
the test of whether SELinux was enabled was dropped.  Restore it.

This is necessary to enable use of setfiles on non-SELinux hosts
without requiring explicit use of the -m option.

Fixes: 602347c742 ("policycoreutils: setfiles - Modify to use selinux_restorecon")
Reported-by: sajjad ahmed <sajjad_ahmed782@yahoo.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Richard Haines <richard_c_haines@btinternet.com>
Reported-by: sajjad ahmed &lt;<a href="mailto:sajjad_ahmed782@yahoo.com" target="_blank">sajjad_ahmed782@yahoo.com</a>&gt;<br>
Signed-off-by: Stephen Smalley &lt;<a href="mailto:sds@tycho.nsa.gov" target="_blank">sds@tycho.nsa.gov</a>&gt;<br>
2019-02-20 11:21:33 +01:00
Petr Lautrbach
60a9285786
python/semanage module: Fix handling of -a/-e/-d/-r options
Previous code traceback-ed when one of the mentioned option was used without
any argument as this state was not handled by the argument parser.

action='store' stores arguments as a list while the original
action='store_const' used str therefore it's needed to convert list to str
before it's sent to moduleRecords class.

Fixes:
^_^ semanage module -a
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 963, in <module>
    do_parser()
  File "/usr/sbin/semanage", line 942, in do_parser
    args.func(args)
  File "/usr/sbin/semanage", line 608, in handleModule
    OBJECT.add(args.module_name, args.priority)
  File "/usr/lib/python3.7/site-packages/seobject.py", line 402, in add
    if not os.path.exists(file):
  File "/usr/lib64/python3.7/genericpath.py", line 19, in exists
    os.stat(path)
TypeError: stat: path should be string, bytes, os.PathLike or integer, not NoneType

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-17 22:35:15 +01:00
Petr Lautrbach
f9ba759d15
python/semanage: Update semanage to use python3
semanage uses seobject which uses setools which is python 3 only.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-17 22:35:15 +01:00
Petr Lautrbach
f9dbd6e83c
python/semanage: Drop python shebang from seobject.py
seobject.py is not supposed to be used as entrypoint therefore the shebang is
unnecessary. It also doesn't need execute bits.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-17 22:35:14 +01:00
Nicolas Iooss
72dc5c6241
python: always use python3 in the shebang of programs using setools
setools 4.2.0 dropped support for Python 2. On systems where
/usr/bin/python is Python 2, several tools are now broken because of
this. Update the shebang of these tools to /usr/bin/python3.

For future reference, as semanage/seobject.py, sepolicy and sepolgen
import setools, every program that uses one of these modules need to be
run with Python 3. The following programs do not use any of these
modules so their shebangs have not been modified:

    dbus/selinux_server.py
    libsemanage/utils/semanage_migrate_store
    mcstrans/share/util/mlscolor-test
    mcstrans/share/util/mlstrans-test
    sandbox/start

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-02-17 22:34:50 +01:00
Nicolas Iooss
9336e435dd
python/sepolicy: drop python shebang from the module
The files in sepolicy's module directory are not supposed to used as
executable files. The shebang line is therefore not needed.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-02-17 22:34:42 +01:00
Petr Lautrbach
ffc59f6015 libsemanage: genhomedircon - improve handling large groups
getgrnam_r() uses a preallocated buffer to store a structure containing
the broken-out fields of the record in the group database. The size of
this buffer is usually sysconf(_SC_GETGR_R_SIZE_MAX) == 1024 and it is
not enough for groups with a large number of users.  In these cases,
getgrnam_r() returns -1 and sets errno to ERANGE and the caller can
retry with a larger buffer.

Fixes:
$ semanage login -a -s user_u -r s0-s0:c1.c2 '%largegroup'
libsemanage.semanage_direct_commit: semanage_genhomedircon returned error code -1. (Numerical result out of range).
OSError: Numerical result out of range

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-13 13:49:05 +01:00
Nicolas Iooss
913613da66
libsepol/cil: silence static analyser's use-after-free warning
clang's static analyze reports a use-after-free in
__cil_expr_to_string(), when __cil_expr_to_string_helper() does not
modify its third parameter (variable s1 here) in this loop:

    for (curr = curr->next; curr; curr = curr->next) {
        __cil_expr_to_string_helper(curr, flavor, &s1);
        cil_asprintf(&c2, "%s %s", c1, s1);
        free(c1);
        free(s1);
        c1 = c2;
    }

Silence this warning by making sure s1 is always NULL at the beginning
of every iteration of the loop.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-02-10 19:32:15 +01:00
Petr Lautrbach
5d59284381
libselinux: Fix RESOURCE_LEAK defects reported by coverity scan
Fixes:

libselinux/src/checkAccess.c:93: leaked_storage: Variable "user_context" going out of scope leaks the storage it points to.
libselinux/src/label_db.c:286: leaked_storage: Variable "filp" going out of scope leaks the storage it points to.
libselinux/src/label_db.c:291: leaked_storage: Variable "filp" going out of scope leaks the storage it points to.
libselinux/src/label_file.c:405: leaked_storage: Variable "str_buf" going out of scope leaks the storage it points to.
libselinux/src/load_policy.c:266: leaked_storage: Variable "names" going out of scope leaks the storage it points to.
libselinux/src/selinux_config.c:183: leaked_storage: Variable "end" going out of scope leaks the storage it points to.
libselinux/src/selinux_config.c:184: overwrite_var: Overwriting "end" in "end = type + strlen(type) - 1" leaks the storage that "end" points to.
libselinux/src/selinux_restorecon.c:376: leaked_storage: Variable "new_entry" going out of scope leaks the storage it points to.
libselinux/src/selinux_restorecon.c:855: leaked_storage: Variable "xattr_value" going out of scope leaks the storage it points to.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-10 17:52:09 +01:00
Petr Lautrbach
9b848852a7
python/semanage: Use standard argparse.error() method in handlePermissive
This method prints a usage message including the message to the standard error
and terminates the program with a status code of 2.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-10 17:06:09 +01:00
Petr Lautrbach
347719d15f
libselinux/selinux_restorecon: Skip customized files also without -v
In the original code, customizable file contexts were not changed only if -v was
used. It lead to different behavior when selinux_restorecon was run with -v and
without it.

Based on an initial patch by Jan Zarsky <jzarsky@redhat.com>

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-10 17:06:00 +01:00
Vit Mojzis
4634e8fe39
gui: Make all polgen button labels translatable
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-10 17:05:48 +01:00
Dan Walsh
e103c5b2ee
dbus: Fix name of polkit function
Add missing action org.selinux.change_default_mode for change_default_mode() and
remove unused action org.selinux.change_policy_type.

Fixes: e8718ef514 ("Make sure we do the polkit check on all dbus interfaces.")

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-10 17:04:19 +01:00
Vit Mojzis
3cad474303
checkpolicy: Update manpage
- Add description of -S option
- Sort the option descriptions based on the synopsis
- Add missing options to synopsis

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-10 17:03:58 +01:00
Vit Mojzis
259ab083fa
python/semanage/seobject: Fix listing boolean values
Fix gathering boolean values by fixing always False if condition
(determining whether the values are listed from local store).

Fix listing boolean values by printing the correct values and not
forcing the use of security_get_boolean_active (which causes
crash when listing booleans that are not present in active policy).

Fixes:
    # dnf install selinux-policy-mls
    # cat > mypolicy.cil
    (boolean xyz false)

    # semodule -i mypolicy.cil -s mls

    # semanage boolean -l -S mls
    ...
    irssi_use_full_network         (off  ,  off)  Allow the Irssi IRC Client to connect to any port, and to bind to any unreserved port.
    mozilla_plugin_use_bluejeans   (off  ,  off)  Allow mozilla plugin to use Bluejeans.
    OSError: No such file or directory

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2019-02-06 21:20:12 +01:00
Nicolas Iooss
bac905ce86 libsepol: do not use uninitialized value for low_value
clang's static analyzer reports a warning when low_bit is used without
having been initialized in statements such as:

    low_value = low_bit << 8;

The warning is: "Result of operation is garbage or undefined".

This is caused by low_bit being only initialized when in_range is true.
This issue is not critical because low_value is only used in an
"if (in_range)" block. Silence this warning by moving low_value's
assignment inside this block.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-02-06 09:08:58 +01:00
James Carter
4ba87e3d2c libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
These were reported by Petr Lautrbach (plautrba@redhat.com) and this
patch was based on his patch with only a few changes.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2019-02-05 09:56:34 +01:00
Petr Lautrbach
f0f68ab2ff scripts/release: Update links to use release assets instead of wiki links
- new release files are created in release/$RELEASE_TAG
- download links refers to new release assets

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-05 09:56:34 +01:00
Dan Walsh
6ded76aa06
python/semanage: Examples are no longer in the main semanage man page
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-04 22:11:26 +01:00
Petr Lautrbach
fdb242ef1b
libselinux: Change matchpathcon usage to match with matchpathcon manpage
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-04 22:11:22 +01:00
Petr Lautrbach
5689d82a44
libselinux: set an appropriate errno in booleans.c
Fixes:
$ mkdir booleans
$ sudo mount --bind ./booleans /sys/fs/selinux/booleans
$ sudo getsebool -a
getsebool:  Unable to get boolean names:  Success

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-02-04 22:11:13 +01:00
Viktor Ashirov
474a09233c
python/restorecon: add force option
This adds 'force' keyword argument to selinux.restorecon() function
using SELINUX_RESTORECON_SET_SPECFILE_CTX flag.

Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
2019-02-04 20:23:32 +01:00
Nicolas Iooss
ae03c821b7
python/sepolicy: fix variable name
modify_button_clicked() used variable "type" in a comparison instead of
"ftype". This is a bug, which has been found with flake8 3.7.0. This
linter reported:

    python/sepolicy/sepolicy/gui.py:1548:20: F823 local variable 'type'
    {0} referenced before assignment

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-31 20:57:28 +01:00
Nicolas Iooss
f906ae66a4
python: use == or != when comparing a variable with a string or a integer
Flake8 3.7.0 added a new fatal error message when parsing Python files:

    python/semanage/semanage:112:16: F632 use ==/!= to compare str, bytes, and int literals
    python/semanage/semanage:124:23: F632 use ==/!= to compare str, bytes, and int literals
    ...
    python/sepolgen/src/sepolgen/output.py:77:8: F632 use ==/!= to compare str, bytes, and int literals
    python/sepolgen/src/sepolgen/output.py:80:8: F632 use ==/!= to compare str, bytes, and int literals
    python/sepolgen/src/sepolgen/output.py:83:8: F632 use ==/!= to compare str, bytes, and int literals
    python/sepolicy/sepolicy/generate.py:646:16: F632 use ==/!= to compare str, bytes, and int literals
    python/sepolicy/sepolicy/generate.py:1349:16: F632 use ==/!= to compare str, bytes, and int literals

Fix all these warnings.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-31 20:57:23 +01:00
Nicolas Iooss
61f7b35b10
python: reindent lines that were over-indented
Flake8 3.7.0 warns about lines that are over-indented, i.e. lines that
are indented with more than 4 spaces:

    python/sepolgen/src/sepolgen/refparser.py:1047:26: E117 over-indented
    python/sepolgen/src/sepolgen/yacc.py:2569:21: E117 over-indented
    python/sepolicy/sepolicy/interface.py:196:13: E117 over-indented
    python/sepolicy/sepolicy/interface.py:198:13: E117 over-indented
    python/sepolicy/sepolicy/interface.py:215:13: E117 over-indented
    python/sepolicy/sepolicy/interface.py:217:13: E117 over-indented
    python/sepolicy/sepolicy/manpage.py:172:13: E117 over-indented
    python/sepolicy/sepolicy/manpage.py:174:13: E117 over-indented

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-31 20:57:17 +01:00
Aleksei Nikiforov
0445e65d83 Allow installing translated man pages
Signed-off-by: Aleksei Nikiforov <darktemplar@basealt.ru>
2019-01-28 12:03:57 +01:00
Aleksei Nikiforov
e3e3873de7 Add man pages translation by Olesya Gerasimenko
Signed-off-by: Olesya Gerasimenko <gammaray@basealt.ru>
Signed-off-by: Aleksei Nikiforov <darktemplar@basealt.ru>
2019-01-28 12:03:57 +01:00
Petr Lautrbach
ae11352bde restorecond: Install DBUS service file with 644 permissions
The original 600 permissions make the service file unreadable for dbus daemon.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1626462

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-01-25 15:03:53 +01:00
Petr Lautrbach
53312c7d61 Update VERSIONs to 2.9-rc1 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-01-25 11:48:54 +01:00
Nicolas Iooss
9e0ed5ce17 scripts: introduce env_use_destdir.sh helper
Set-up environment variables in order to use DESTDIR in Python, Ruby,
etc. This makes testing Python scripts easier.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-21 12:13:41 +01:00
Nicolas Iooss
dbcada0621 Travis-CI: add Ruby 2.6 to the test matrix
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-21 12:13:41 +01:00
Nicolas Iooss
111c541c46 Travis-CI: upgrade PyPy to 6.0
PyPy 6.0 was released in April 2018 but became available on Travis-CI
only recently. Now that it is available, use it.

While at it, compile Python modules with libpypy-c.so, now that PyPy
provides this library. This would enable linking Python modules with
-Wl,-no-undefined (or -Wl,-z,defs) and help fixing issues with
https://github.com/SELinuxProject/selinux/pull/130.

Tracking issues:
* https://github.com/travis-ci/travis-ci/issues/9542
* https://travis-ci.community/t/pypy-2-7-on-xenial/889

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-21 12:13:41 +01:00
Petr Lautrbach
de5d5ede60 libselinux/audit2why.so: Filter out non-python related symbols
audit2why.so used to export libsepol.a symbols. We only need Python related
symbols:

- initaudit2why for python 2
- PyInit_audit2why for python3

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-01-21 12:13:41 +01:00
Nicolas Iooss
689a6eb576 libselinux: do not dereference symlink with statfs in selinux_restorecon
When selinux_restorecon() is used to relabel symlinks, it performs the
following syscalls (as seen by running strace on restorecond):

    lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
    statfs("/root/symlink", 0x7ffd6bb4d090) = -1 ENOENT (No such file or directory)
    lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
    lgetxattr("/root/symlink", "security.selinux", "sysadm_u:object_r:user_home_t", 255) = 30

The second one triggers a SELinux check for lnk_file:read, as statfs()
dereferences symbolic links. This call to statfs() is only used to find
out whether "restoreconlast" xattr can be ignored, which is always the
case for non-directory files (the first syscall, lstat(), is actually
used to perform this check).

Skip the call to statfs() when setrestoreconlast is already false.

This silences an AVC denial that would otherwise be reported to
audit.log (cf. https://github.com/SELinuxProject/refpolicy/pull/22).

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-18 11:13:19 -05:00
Stephen Smalley
c78f9c355f setsebool: support use of -P on SELinux-disabled hosts
As reported in #123, setsebool immediately exits with an error if
SELinux is disabled, preventing its use for setting boolean persistent
values.  In contrast, semanage boolean -m works on SELinux-disabled
hosts.  Change setsebool so that it can be used with the -P option
(persistent changes) even if SELinux is disabled.  In the SELinux-disabled
case, skip setting of active boolean values, but set the persistent value
in the policy store.  Policy reload is automatically disabled by libsemanage
when SELinux is disabled, so we only need to call semanage_set_reload()
if -N was used.

Fixes: https://github.com/SELinuxProject/selinux/issues/123
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2019-01-17 13:56:05 -05:00
Nicolas Iooss
9dad37e37a
python/sepolicy: initialize mislabeled_files in __init__()
Using "sepolicy gui" sometimes leads to an exception when entering the
Files tab:

    Traceback (most recent call last):
      File "python/sepolicy/sepolicy/gui.py", line 1345, in tab_change
        self.show_mislabeled_files_only.set_visible(self.mislabeled_files)
    AttributeError: 'SELinuxGui' object has no attribute 'mislabeled_files'

Indeed, when application_selected() calls show_applications_page(), this
function calls tab_change(), which can use mislabeled_files in this
line:

    self.show_mislabeled_files_only.set_visible(self.mislabeled_files)

Make sure that mislabeled_files is initialized by defining it in
__init__(), in order to fix this error. Its value will be properly set
later, by calling several initializers, which is why the original
assignment to False is kept in:

    self.mislabeled_files = False
    self.executable_files_initialize(app)
    self.network_initialize(app)
    self.writable_files_initialize(app)
    self.transitions_into_initialize(app)
    self.transitions_from_initialize(app)
    self.application_files_initialize(app)
    self.transitions_files_initialize(app)

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-16 21:29:17 +01:00
Stephen Smalley
dc3d9c6d71
libsemanage: set selinux policy root around calls to selinux_boolean_sub
As reported in #109, semodule -p /path/to/policyroot -s minimum -n -B
tries to use /etc/selinux/targeted/booleans.subs_dist.  This is because
it invokes the libselinux selinux_boolean_sub() interface, which uses
the active/installed policy files rather than the libsemanage ones.

Switch the selinux policy root around the selinux_boolean_sub() call
to incorporate the semanage root as a prefix and to use the specified
policy store as a suffix so that the correct booleans.subs_dist file
(if any) is used.

The underlying bug is that booleans.subs_dist is not itself managed
via libsemanage. If it was managed and therefore lived within the
policy store, then libsemanage could access the appropriate
booleans.subs_dist file without using the libselinux interface at all,
and thus would not need to modify the selinux policy root.  Moving
booleans.subs_dist to a managed file is deferred to a future change.

Test:
dnf install selinux-policy-minimum selinux-policy-targeted
cd / && tar cf - etc/selinux var/lib/selinux | (cd ~/policy-root; tar xvpf -)
strace semodule -p ~/policy-root -s minimum -n -B

Before:
openat(AT_FDCWD, "/etc/selinux/targeted/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5

After:
openat(AT_FDCWD, "/home/sds/policy-root/etc/selinux/minimum/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5

Fixes https://github.com/SELinuxProject/selinux/issues/109

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2019-01-12 19:01:24 +01:00
Nicolas Iooss
bb518a01e9 scripts/run-flake8: run on Python scripts not ending with .py
When running flake8 on a directory, it does not analyze files without an
extension, like semanage_migrate_store, mlscolor-test, etc. Use grep to
find files with a Python shebang and build a list which is then given to
flake8.

This commit is possible now that some clean-up patches have been
applied, such as commit 69c56bd2f6 ("python/chcat: improve the code
readability") and b7227aaec1 ("mcstrans: fix Python linter warnings on
test scripts") and 3cb974d2d2 ("semanage_migrate_store: fix many
Python linter warnings").

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 13:21:09 +01:00
Nicolas Iooss
aa3ddfed93 python: run all the tests with "make test"
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 10:15:46 +01:00
Nicolas Iooss
916640d786 python/sepolgen: refpolicy installs its Makefile in include/Makefile
When running "make install-headers" on refpolicy,
/usr/share/selinux/refpolicy/Makefile does not exist but
/usr/share/selinux/refpolicy/include/Makefile does. Use it when
available.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 10:15:46 +01:00
Nicolas Iooss
e1f2db5887 python/audit2allow: use local sepolgen-ifgen-attr-helper for tests
Introduce option --attr-helper to sepolgen-ifgen to make it possible to
override /usr/bin/sepolgen-ifgen-attr-helper and use it in the testuite
in order to test the helper which has been compiled from the project
instead of the one installed on the system.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 10:15:46 +01:00
Nicolas Iooss
4ac069a3ee python/audit2allow: make the tests useful again
audit2allow testsuite requires a system which uses SELinux with a MLS
policy. This is a lot to ask for a continuous integretation system.
Thankfully this can be worked around by using option -p to run the tools
with a specific configuration. Doing this, the testsuite can even be run
on a system without SELinux.

This approach requires building a custom policy for parsing test.log.
Add a minimal policy written in CIL for this need.

While at it:
* Do not invoke "sudo sepolgen-ifgen" but produce a file in a writable
  directory (instead of /var/lib/sepolgen/interface_info)
* Use sys.executable instead of 'python', in order to really test
  python3 and python2 when calling the test script with one of these
  interpreters.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 10:15:46 +01:00
Nicolas Iooss
53c7a046ff Travis-CI: download refpolicy and install headers
This is needed in order to run sepolgen-ifgen in audit2allow testsuite.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-08 10:15:46 +01:00
Nicolas Iooss
fbc7248ffa python/semanage: explain why sepolicy is imported in a function
Importing modules inside functions is quite uncommon in Python. This is
nevertheless required with sepolicy because it loads the current SELinux
policy when it is imported (and raises ValueError when this fails).

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-07 12:50:45 +01:00
Nicolas Iooss
b2a54258b4 python/audit2allow: allow using audit2why as non-root user
Importing sepolicy as non-root on a system with SELinux causes the
following exception to be raised:

    ValueError: No SELinux Policy installed

Ignore this when using audit2why, which allows using it with option
--policy as a non-root user.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-07 12:50:45 +01:00