From 2a020a9fa4601195ec4b2649bfe481b3f0f4ac68 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mar 09 2020 12:21:45 +0000 Subject: [PATCH 1/3] Revert "framework: sepolicy.info() returns a generator, not a list" This reverts commit 4657ec5b42108ab97ec654d65b5d36332b11c1e4. The pach is no longer relevant since commit e3a656b is being reverted due to performance issues. --- diff --git a/framework/src/setroubleshoot/audit_data.py b/framework/src/setroubleshoot/audit_data.py index 6f0e1e8..ad291e8 100644 --- a/framework/src/setroubleshoot/audit_data.py +++ b/framework/src/setroubleshoot/audit_data.py @@ -734,10 +734,10 @@ class AVC: def __typeMatch(self, context, type_list): # get array of context type and it's aliases try: - _info = next(info(TYPE, context.type)) + _info = info(TYPE, context.type)[0] ctypes = _info.get('aliases', []) ctypes.append(_info['name']) - except (RuntimeError, IndexError, StopIteration): + except (RuntimeError, IndexError): ctypes = [context.type] for type in type_list: From c61cf16ed29222ec2aecc80d7322d489ec1ad104 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mar 09 2020 12:21:45 +0000 Subject: [PATCH 2/3] Revert "framework: Fix AVC.__typeMatch to handle aliases properly" This reverts commit c55edb36ca68a783f7b61d306e81163b8d464325. The patch caused significant slowdown of plugin evaluation and since it is not strictly necessary (aliases can only be introduced via plugins - an AVC message will always contain the original type name), I am reverting it. Test checking use of aliases in plugins will be used instead. --- diff --git a/framework/src/setroubleshoot/audit_data.py b/framework/src/setroubleshoot/audit_data.py index ad291e8..d66e757 100644 --- a/framework/src/setroubleshoot/audit_data.py +++ b/framework/src/setroubleshoot/audit_data.py @@ -732,18 +732,9 @@ class AVC: return False def __typeMatch(self, context, type_list): - # get array of context type and it's aliases - try: - _info = info(TYPE, context.type)[0] - ctypes = _info.get('aliases', []) - ctypes.append(_info['name']) - except (RuntimeError, IndexError): - ctypes = [context.type] - for type in type_list: - for t in ctypes: - if re.match(type, t): - return True + if re.match(type, context.type): + return True return False def matches_source_types(self, type_list): From 4fada87d50a6c16f404f8fbe59cf7ccb687185d6 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mar 09 2020 12:21:45 +0000 Subject: [PATCH 3/3] plugins: Update deprecated type references Update references to types that have been removed from the policy (or where misspelled) and replace aliases with correspondig type names. Removals: file_t - dec2bd3925 - 2014-01-10 insmod/depmod/update_modules - aa6253cf8d - 2019-02-26 Misspelled: dhclient_t -> dhcpc_t semange_read_lock_t -> semanage_read_lock_t --- diff --git a/plugins/src/catchall_labels.py b/plugins/src/catchall_labels.py index aa83cc0..fd93a6b 100644 --- a/plugins/src/catchall_labels.py +++ b/plugins/src/catchall_labels.py @@ -48,7 +48,7 @@ restorecon -v '$FIX_TARGET_PATH' self.set_priority(5) def analyze(self, avc): - if (avc.syscall != 'execve' and avc.matches_target_types(['file_t', 'unlabeled_t', 'usr_t', 'etc_t', 'mnt_t', 'var_t', 'var_lib_t', 'default_t']) and + if (avc.syscall != 'execve' and avc.matches_target_types(['unlabeled_t', 'usr_t', 'etc_t', 'mnt_t', 'var_t', 'var_lib_t', 'default_t']) and avc.has_tclass_in(['dir', 'file', 'lnk_file', 'sock_file'])): allowed_types = avc.allowed_target_types() if allowed_types: diff --git a/plugins/src/kernel_modules.py b/plugins/src/kernel_modules.py index 17816d3..17e627a 100644 --- a/plugins/src/kernel_modules.py +++ b/plugins/src/kernel_modules.py @@ -54,10 +54,10 @@ class plugin(Plugin): avc.matches_target_types(['modules_object_t', 'modules_conf_t', 'modules_dep_t', - 'insmod_exec_t', - 'depmod_exec_t', - 'update_modules_exec_t', - 'update_modules_tmp_t', + 'kmod_exec_t', + 'kmod_exec_t', + 'kmod_exec_t', + 'kmod_tmp_t', 'boot_t', 'system_map_t' ])): diff --git a/plugins/src/restorecon.py b/plugins/src/restorecon.py index 9233f12..e3044c7 100644 --- a/plugins/src/restorecon.py +++ b/plugins/src/restorecon.py @@ -73,7 +73,7 @@ class plugin(Plugin):
  • The SELinux policy might override the default label inherited from the parent directory by specifying a process running in context A which creates a file in a directory labeled B will instead create the file with label C. An example of this would be the dhcp client running - with the dhclient_t type and creating a file in the directory /etc. This file would normally + with the dhcpc_t type and creating a file in the directory /etc. This file would normally receive the etc_t type due to parental inheritance but instead the file is labeled with the net_conf_t type because the SELinux policy specifies this.
  • Users can change the file context on a file using tools such as chcon, or restorecon. diff --git a/plugins/src/selinuxpolicy.py b/plugins/src/selinuxpolicy.py index c26a74c..7adaa6b 100644 --- a/plugins/src/selinuxpolicy.py +++ b/plugins/src/selinuxpolicy.py @@ -55,7 +55,7 @@ class plugin(Plugin): 'default_context_t', 'file_context_t', 'semanage_store_t', - 'semange_read_lock_t', + 'semanage_read_lock_t', 'semanage_trans_lock_t', 'load_policy_exec_t', 'setfiles_exec_t',