diff --git a/0001-Make-seinfo-output-predictable.patch b/0001-Make-seinfo-output-predictable.patch new file mode 100644 index 0000000000000000000000000000000000000000..eefade6ac124d23d66a29a9d7df5737226c18274 --- /dev/null +++ b/0001-Make-seinfo-output-predictable.patch @@ -0,0 +1,90 @@ +From 8ed316d6bfb65e5e9b57f3761ea8490022ab3a05 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 18 Nov 2021 13:59:08 +0100 +Subject: [PATCH] Make seinfo output predictable + +There are few places where frozenset is used. Given that frozenset is an unordered +collection the output generated from this is unpredictable. + +The following command outputs are fixed using sorted() on frozensets: + + seinfo --constrain + seinfo --common + seinfo -c -x + seinfo -r -x + seinfo -u -x + +Fixes: https://github.com/SELinuxProject/setools/issues/65 + +Signed-off-by: Petr Lautrbach +--- + setools/policyrep/constraint.pxi | 2 +- + setools/policyrep/objclass.pxi | 4 ++-- + setools/policyrep/role.pxi | 2 +- + setools/policyrep/user.pxi | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/setools/policyrep/constraint.pxi b/setools/policyrep/constraint.pxi +index 01c63d87425b..0b4c5b9bcf6a 100644 +--- a/setools/policyrep/constraint.pxi ++++ b/setools/policyrep/constraint.pxi +@@ -72,7 +72,7 @@ cdef class Constraint(BaseConstraint): + + def statement(self): + if len(self.perms) > 1: +- perms = "{{ {0} }}".format(' '.join(self.perms)) ++ perms = "{{ {0} }}".format(' '.join(sorted(self.perms))) + else: + # convert to list since sets cannot be indexed + perms = list(self.perms)[0] +diff --git a/setools/policyrep/objclass.pxi b/setools/policyrep/objclass.pxi +index b7ec7b7de5c3..8ed2be5a9bed 100644 +--- a/setools/policyrep/objclass.pxi ++++ b/setools/policyrep/objclass.pxi +@@ -75,7 +75,7 @@ cdef class Common(PolicySymbol): + return other in self.perms + + def statement(self): +- return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(self.perms)) ++ return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(sorted(self.perms))) + + + cdef class ObjClass(PolicySymbol): +@@ -204,7 +204,7 @@ cdef class ObjClass(PolicySymbol): + + # a class that inherits may not have additional permissions + if len(self.perms) > 0: +- stmt += "{{\n\t{0}\n}}".format('\n\t'.join(self.perms)) ++ stmt += "{{\n\t{0}\n}}".format('\n\t'.join(sorted(self.perms))) + + return stmt + +diff --git a/setools/policyrep/role.pxi b/setools/policyrep/role.pxi +index 9a0dd39f27d9..3af8a3f72a1f 100644 +--- a/setools/policyrep/role.pxi ++++ b/setools/policyrep/role.pxi +@@ -58,7 +58,7 @@ cdef class Role(PolicySymbol): + if count == 1: + stmt += " types {0}".format(types[0]) + else: +- stmt += " types {{ {0} }}".format(' '.join(types)) ++ stmt += " types {{ {0} }}".format(' '.join(sorted(types))) + + stmt += ";" + return stmt +diff --git a/setools/policyrep/user.pxi b/setools/policyrep/user.pxi +index 9c82aa92eb72..e37af2939820 100644 +--- a/setools/policyrep/user.pxi ++++ b/setools/policyrep/user.pxi +@@ -81,7 +81,7 @@ cdef class User(PolicySymbol): + if count == 1: + stmt += roles[0] + else: +- stmt += "{{ {0} }}".format(' '.join(roles)) ++ stmt += "{{ {0} }}".format(' '.join(sorted(roles))) + + if self._level: + stmt += " level {0.mls_level} range {0.mls_range};".format(self) +-- +2.33.1 + diff --git a/0002-Require-networkx-on-package-level.patch b/0002-Require-networkx-on-package-level.patch new file mode 100644 index 0000000000000000000000000000000000000000..114c7a9a024b250d179f1b861adac5233000eb95 --- /dev/null +++ b/0002-Require-networkx-on-package-level.patch @@ -0,0 +1,24 @@ +From 7b73bdeda54b9c944774452bfa3b3c1f2733b3f0 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 2 Apr 2020 16:06:14 +0200 +Subject: [PATCH 2/2] Require networkx on package level + +It allows us to ship python3-setools without dependency on python3-networkx +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index c593b786cc61..0551811e3fd1 100644 +--- a/setup.py ++++ b/setup.py +@@ -163,5 +163,5 @@ setup(name='setools', + # setup also requires libsepol and libselinux + # C libraries and headers to compile. + setup_requires=['setuptools', 'Cython>=0.27'], +- install_requires=['setuptools', 'networkx>=2.0'] ++ install_requires=['setuptools'] + ) +-- +2.30.0 + diff --git a/4.4.0.tar.gz b/4.4.0.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..c34148688f1232148cdfd6a626e0fe04723f3b0e Binary files /dev/null and b/4.4.0.tar.gz differ diff --git a/apol.desktop b/apol.desktop new file mode 100644 index 0000000000000000000000000000000000000000..727733a5b34c2450d6726670a87804f4b37f6f31 --- /dev/null +++ b/apol.desktop @@ -0,0 +1,11 @@ +[Desktop Entry] +Name=SELinux Policy Analysis +GenericName=SELinux Policy Analysis Tool +Comment=This tool can examine, search, and relate policy components and policy rules +Icon=apol +Exec=/usr/bin/apol +Type=Application +Terminal=false +Categories=System; +X-Desktop-File-Install-Version=0.2 +StartupNotify=true diff --git a/setools.pam b/setools.pam new file mode 100644 index 0000000000000000000000000000000000000000..c7d67e3321c017444f90acf81cb2601c1a594a15 --- /dev/null +++ b/setools.pam @@ -0,0 +1,4 @@ +#%PAM-1.0 +auth include config-util +account include config-util +session include config-util diff --git a/setools.spec b/setools.spec new file mode 100644 index 0000000000000000000000000000000000000000..4ffaf8725bec22072d2260fa2686ef6b2b5e03ad --- /dev/null +++ b/setools.spec @@ -0,0 +1,129 @@ +%define anolis_release 1 + +Name: setools +Version: 4.4.0 +Release: %{anolis_release}%{?dist} +Summary: Policy analysis tools for SELinux + +License: GPLv2 +URL: https://github.com/SELinuxProject/setools/ +Source0: https://github.com/SELinuxProject/setools/archive/refs/tags/%{version}.tar.gz +Source1: setools.pam +Source2: apol.desktop + +Patch0001: 0001-Make-seinfo-output-predictable.patch +Patch0002: 0002-Require-networkx-on-package-level.patch + +BuildRequires: flex, bison vim +BuildRequires: glibc-devel, gcc, git-core +BuildRequires: libsepol-devel >= 3.2-1, libsepol-static >= 3.2-1 +BuildRequires: qt5-qtbase-devel +BuildRequires: swig +BuildRequires: python3-Cython +BuildRequires: python3-devel +BuildRequires: python3-setuptools +BuildRequires: libselinux-devel + +# This package is need for Test +BuildRequires: python3-pip python3-networkx checkpolicy + +Requires: %{name}-console = %{version}-%{release} +Requires: %{name}-console-analyses = %{version}-%{release} +Requires: %{name}-gui = %{version}-%{release} + +Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 + +%description +SETools is a collection of graphical tools, command-line tools, and +Python modules designed to facilitate SELinux policy analysis. + +%package console +Summary: Policy analysis command-line tools for SELinux +License: GPLv2 +Requires: python3-setools = %{version}-%{release} +Requires: libselinux >= 3.2-1 + +%description console +This package includes the following console tools: + sediff Compare two policies to find differences. + seinfo List policy components. + sesearch Search rules (allow, type_transition, etc.) + +%package console-analyses +Summary: Policy analysis command-line tools for SELinux +License: GPLv2 +Requires: python3-setools = %{version}-%{release} +Requires: libselinux >= 3.2-1 +Requires: python3-networkx + +%description console-analyses +The console analyses package for %{name}. + +%package -n python3-setools +Summary: Policy analysis tools for SELinux +Obsoletes: %{name}-libs < 4.0.0 +Recommends: libselinux-python3 +%{?python_provide:%python_provide python3-setools} +Requires: python3-setuptools + +%description -n python3-setools +The python package for %{name}. + +%package gui +Summary: Policy analysis graphical tools for SELinux +Requires: python3-setools = %{version}-%{release} +Requires: python3-qt5 +Requires: python3-networkx + +%description gui +The gui package for %{name}. + +%prep +%autosetup -n setools-%{version} -p1 + +%build +%py3_build + +%install +%py3_install + +%check +%{__python3} setup.py test + +%files + +%files console +%{_bindir}/sechecker +%{_bindir}/sediff +%{_bindir}/seinfo +%{_bindir}/sesearch +%{_mandir}/man1/sechecker* +%{_mandir}/man1/sediff* +%{_mandir}/man1/seinfo* +%{_mandir}/man1/sesearch* +%{_mandir}/ru/man1/sediff* +%{_mandir}/ru/man1/seinfo* +%{_mandir}/ru/man1/sesearch* + +%files console-analyses +%{_bindir}/sedta +%{_bindir}/seinfoflow +%{_mandir}/man1/sedta* +%{_mandir}/man1/seinfoflow* +%{_mandir}/ru/man1/sedta* +%{_mandir}/ru/man1/seinfoflow* + +%files -n python3-setools +%license COPYING COPYING.GPL COPYING.LGPL +%{python3_sitearch}/setools +%{python3_sitearch}/setools-* + +%files gui +%{_bindir}/apol +%{python3_sitearch}/setoolsgui +%{_mandir}/man1/apol* +%{_mandir}/ru/man1/apol* + +%changelog +* Fri Apr 15 2022 happy_orange - 4.4.0-1 +- Init package from upstream