Go to file
Nicolas Iooss f39c0ac637 python/chcat: fix removing categories on users with Fedora default setup
Using Vagrant with fedora/28-cloud-base image, SELinux logins are
configured this way:

    # semanage login -l
    Login Name           SELinux User         MLS/MCS Range        Service

    __default__          unconfined_u         s0-s0:c0.c1023       *
    root                 unconfined_u         s0-s0:c0.c1023       *
    vagrant              unconfined_u         s0-s0:c0.c1023       *

Using "chcat -l +c42 vagrant" successfully adds the category to user
vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
semanage login -l returns:

    vagrant              unconfined_u         s0-s0:c0.c1023,c42   *

This issue is caused by expandCats(), which refuses to return a list of
more than 25 categories. This causes chcat_user_remove() to work with
cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
it not been able to remove 'c42' from the list.

Fix this issue by splitting the list of categories before calling
expandCats().

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2018-12-11 12:39:09 +01:00
checkpolicy checkpolicy: Add option to sort ocontexts when creating a binary policy 2018-10-12 13:38:00 -04:00
dbus dbus: remove deprecated at_console statement 2018-11-22 10:03:30 +01:00
gui gui: remove html_util.py 2018-11-22 10:03:49 +01:00
libselinux libselinux: selinux_restorecon: fix printf format string specifier for uint64_t 2018-11-10 17:32:06 +01:00
libsemanage libsemanage: improve semanage_migrate_store import failure 2018-10-11 10:53:18 -04:00
libsepol libsepol: ibpkeys.c: fix printf format string specifiers for subnet_prefix 2018-11-23 21:38:44 +01:00
mcstrans mcstrans: remove unused getpeercon_raw() call 2018-10-26 09:53:11 -04:00
policycoreutils policycoreutils/hll/pp: remove unused variable 2018-06-06 15:56:45 -04:00
python python/chcat: fix removing categories on users with Fedora default setup 2018-12-11 12:39:09 +01:00
restorecond restorecond: Do not ignore the -f option 2018-10-11 10:53:08 -04:00
sandbox Fix minor typos 2018-06-30 20:28:25 +02:00
scripts python: remove semicolon from end of lines 2018-08-19 17:55:19 +02:00
secilc secilc: better error handling 2018-09-25 08:05:41 -07:00
semodule-utils Update VERSIONs to 2.8 for release. 2018-05-24 14:21:09 -04:00
.gitignore restorecond: Add gitignore 2016-11-16 11:20:05 -05:00
.travis.yml Travis-CI: upgrade to Ubuntu 16.04 LTS Xenial Xerus 2018-08-19 17:55:17 +02:00
CleanSpec.mk Add empty top level Android.mk / CleanSpec.mk files 2015-04-16 07:54:09 -04:00
Makefile build: setup buildpaths if DESTDIR is specified 2018-02-14 20:02:03 +01:00
README README: Update the SELinux mailing list location 2018-10-16 11:08:39 -04:00

Please submit all bug reports and patches to selinux@vger.kernel.org.
Subscribe by sending "subscribe selinux" in the body of an email
to majordomo@vger.kernel.org.

Build dependencies on Fedora:
yum install audit-libs-devel bison bzip2-devel dbus-devel dbus-glib-devel flex flex-devel flex-static glib2-devel libcap-devel libcap-ng-devel pam-devel pcre-devel python-devel setools-devel swig xmlto redhat-rpm-config

To build and install everything under a private directory, run:
make DESTDIR=~/obj install install-pywrap

To install as the default system libraries and binaries
(overwriting any previously installed ones - dangerous!),
on x86_64, run:
make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel
or on x86 (32-bit), run:
make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace
lacks library functions or other dependencies relied upon by your
distribution.  If it breaks, you get to keep both pieces.

To install libsepol on macOS (mainly for policy analysis):
cd libsepol; make PREFIX=/usr/local install

This requires GNU coreutils (brew install coreutils).