RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-18 12:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,939 Commits 4 Branches 709 Tags 22 MiB
C 74.6%
Python 16.2%
Roff 5.2%
SWIG 1.1%
Makefile 1.1%
Other 1.8%
9e81e611c7
Go to file
James Carter 9e81e611c7 libsepol: Fix neverallow checking to also check the other types when 
self is included in a target type set.

When neverallow checking was refactored in commit 9e6840e, self
was not handled correctly. The assumption was made that self only
appeared by itself as a target type, when it may appear in a list of
types. Because of this, if self appears in a target type set of a
neverallow, the other types in the type set are not checked.

Example:

allow TYPE1 TYPE2:CLASS1 { PERM1 };
neverallow TYPE1 {TYPE2 self}:CLASS1 { PERM1 };

The old assertion checking would not find a violation in the rules
above because the target type TYPE2 would be ignored.

This fix will cause all of the types in a target list that includes
self to be checked.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-11-30 10:19:02 -05:00
checkpolicy checkpolicy: remove -lfl from LDLIBS 2016-11-29 08:46:43 -05:00
dbus Add stub make test targets to new subdirs 2016-11-16 11:20:05 -05:00
gui Add stub make test targets to new subdirs 2016-11-16 11:20:05 -05:00
libselinux libsepol,libselinux,audit2allow: teach audit2why about type bounds failures 2016-11-29 15:53:59 -05:00
libsemanage libsepol,libsemanage: write file name in flex output 2016-11-29 08:47:36 -05:00
libsepol libsepol: Fix neverallow checking to also check the other types when 2016-11-30 10:19:02 -05:00
mcstrans mcstrans/utils: make "make all" use $DESTDIR 2016-11-29 08:44:46 -05:00
policycoreutils Drop ChangeLog files 2016-11-16 12:10:58 -05:00
python python/semanage/semanage: Unify argument handling 2016-11-30 09:33:58 -05:00
restorecond restorecond: Add gitignore 2016-11-16 11:20:05 -05:00
sandbox sandbox: make test not fail on systems without SELinux 2016-11-17 16:44:57 -05:00
scripts Fix release script 2016-11-16 11:19:51 -05:00
secilc secilc: Add secil2conf which creates a policy.conf from CIL policy 2016-11-30 10:18:19 -05:00
semodule-utils semodule-utils: Drop -lselinux from Makefiles. 2016-11-16 11:19:51 -05:00
.gitignore restorecond: Add gitignore 2016-11-16 11:20:05 -05:00
CleanSpec.mk Add empty top level Android.mk / CleanSpec.mk files 2015-04-16 07:54:09 -04:00
Makefile Build mcstrans. 2016-11-16 11:19:50 -05:00
README Add redhat-rpm-config as a build dependency on Fedora. 2016-05-04 15:54:27 -04:00

README 

Please submit all bug reports and patches to selinux@tycho.nsa.gov.
Subscribe via selinux-join@tycho.nsa.gov.

Build dependencies on Fedora:
yum install audit-libs-devel bison bzip2-devel dbus-devel dbus-glib-devel flex flex-devel flex-static glib2-devel libcap-devel libcap-ng-devel pam-devel pcre-devel python-devel setools-devel swig ustr-devel xmlto redhat-rpm-config

To build and install everything under a private directory, run:
make DESTDIR=~/obj install install-pywrap

To install as the default system libraries and binaries
(overwriting any previously installed ones - dangerous!),
on x86_64, run:
make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel
or on x86 (32-bit), run:
make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace
lacks library functions or other dependencies relied upon by your
distribution.  If it breaks, you get to keep both pieces.