Skip to content

Commit d3dbddb

Browse files
pebenitopebenito
authored
Merge pull request #105 from pebenito/4.4
Backport fixes for 4.4.3.
2 parents d8d0dcc + f6f812b commit d3dbddb

File tree

16 files changed

+127
-28
lines changed

16 files changed

+127
-28
lines changed

‎.github/workflows/tests.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ jobs:
2727

2828
matrix:
2929
build-opts:
30-
- {python: '3.6', tox: py36}
31-
- {python: '3.7', tox: py37}
32-
- {python: '3.8', tox: py38}
33-
- {python: '3.9', tox: py39}
34-
- {python: '3.10', tox: py310}
35-
- {python: '3.11', tox: py311}
30+
- {python: '3.6', tox: python3.6}
31+
- {python: '3.7', tox: python3.7}
32+
- {python: '3.8', tox: python3.8}
33+
- {python: '3.9', tox: python3.9}
34+
- {python: '3.10', tox: python3.10}
35+
- {python: '3.11', tox: python3.11}
3636
- {python: '3.6', tox: pep8}
3737
- {python: '3.6', tox: lint}
3838
- {python: '3.6', tox: mypy}

‎ChangeLog‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
*setools-4-4.3 (27 Jul 2023)
2+
* Fix compilation with Cython 3.0.0.
3+
* Improve man pages.
4+
* Remove neverallow options in sediff.
5+
* Add -r option to seinfoflow to get flows into the source type.
6+
* Reject a rule with no permissions as invalid policy.
7+
18
*setools-4-4.2 (19 Apr 2023)
29

310
* Make NetworkX optional. sedta and seinfoflow tools, along with the

‎man/ru/sediff.1‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,16 +57,12 @@ sediff \- утилита выявления различий политик SELi
5757
Найти различия правил включения журналирования событий.
5858
.IP "--dontaudit"
5959
Найти различия правил запрета журналирования событий.
60-
.IP "--neverallow"
61-
Найти различия запрещающих правил.
6260
.IP "--allowxperm"
6361
Найти различия расширенных разрешительных правил.
6462
.IP "--auditallowxperm"
6563
Найти различия расширенных правил включения журналирования событий.
6664
.IP "--dontauditxperm"
6765
Найти различия расширенных правил запрета журналирования событий.
68-
.IP "--neverallowxperm"
69-
Найти различия расширенных запрещающих правил.
7066
.IP "-T, --type_trans"
7167
Найти различия правил перехода типов.
7268
.IP "--type_member"

‎man/sechecker.1‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ A space-separated list of object class criteria for the query.
8181
A space-separated list of permissions for the query.
8282

8383
.PP
84-
\fBA least one of the above options must be set in this check.\fR
84+
\fBAt least one of the above options must be set in this check.\fR
8585

8686
.PP
8787
Additional Options:
@@ -123,7 +123,7 @@ The source role criteria for the query.
123123
The target role criteria for the query.
124124

125125
.PP
126-
\fBA least one of the above options must be set in this check.\fR
126+
\fBAt least one of the above options must be set in this check.\fR
127127

128128
.PP
129129
Additional Options:
@@ -205,7 +205,7 @@ executable types are read-only.\fR
205205
.\}
206206
.nf
207207
[ro_execs]
208-
check_type = empty_typeattr
208+
check_type = ro_execs
209209
desc = Verify that the all executables and libraries are read-only.
210210
.fi
211211
.if n \{\

‎man/sediff.1‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,12 @@ Find differences in allow rules.
5050
Find differences in auditallow rules.
5151
.IP "--dontaudit"
5252
Find differences in dontaudit rules.
53-
.IP "--neverallow"
54-
Find differences in neverallow rules.
5553
.IP "--allowxperm"
5654
Find differences in allowxperm rules.
5755
.IP "--auditallowxperm"
5856
Find differences in auditallowxperm rules.
5957
.IP "--dontauditxperm"
6058
Find differences in dontauditxperm rules.
61-
.IP "--neverallowxperm"
62-
Find differences in neverallowxperm rules.
6359
.IP "-T, --type_trans"
6460
Find differences in type_transition rules.
6561
.IP "--type_member"
@@ -88,6 +84,10 @@ Find differences in validatetrans rules.
8884
Find differences in mlsvalidatetrans rules.
8985

9086
.SS Labeling Statement Differences
87+
.IP "--ibendportcon"
88+
Find differences in ibendportcon (InfiniBand endport context) statements.
89+
.IP "--ibpkeycon"
90+
Find differences in ibpkeycon (InfiniBand parition key context) statements.
9191
.IP "--initialsid"
9292
Find differences in initial SID statements.
9393
.IP "--fs_use"
@@ -140,6 +140,14 @@ For example, a class is modified if one or more permissions are added or removed
140140
.RE
141141
.PP
142142

143+
.SH EXAMPLE
144+
.nf
145+
Show differences in boolean settings
146+
# sediff -b /backup/policy.33 /etc/selinux/targeted/policy/policy.33
147+
Show statistics for allow and allowxperm rule changes (how many rules where added, removed, or modified)
148+
#sediff -A --stats /backup/policy.33 /etc/selinux/targeted/policy/policy.33
149+
150+
143151
.SH AUTHOR
144152
Chris PeBenito <[email protected]>
145153

‎man/sedta.1‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ Specify the maximum number of domain transitions to output. The default is unlim
4949
A space-separated list of types to exclude from the analysis.
5050

5151
.SS General Options
52+
.IP "--full"
53+
Print rule lists for transitions.
5254
.IP "--stats"
5355
Print domain transition graph statistics at the end of the analysis.
5456
.IP "-h, --help"
@@ -60,6 +62,13 @@ Print additional informational messages.
6062
.IP "--debug"
6163
Enable debugging output.
6264

65+
.SH EXAMPLE
66+
.nf
67+
Show the shortest transition paths from httpd_t to unconfined_t, while not using container_runtime_t
68+
# sedta -s httpd_t -t unconfined_t -S container_runtime_t
69+
List all domain transition paths shorter than 3 steps from init_t to smbd_t
70+
# sedta -s init_t -t smbd_t -A 3
71+
6372
.SH AUTHOR
6473
Chris PeBenito <[email protected]>
6574

‎man/seinfo.1‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@ There is no expanded information for this component.
5656
.IP "--genfscon [FS_TYPE]"
5757
Print a list of genfscon statements or, if FS_TYPE is provided, print the statement for the named filesystem type.
5858
There is no expanded information for this component.
59+
.IP "--ibpkeycon [PKEY[-PKEY]]"
60+
Print a list of InfiniBand parition key contexts.
61+
.IP "--ibendportcon [NAME]"
62+
Print a list of InfiniBand endport contexts.
5963
.IP "--initialsid [NAME]"
6064
Print a list of initial SIDs or, if NAME is provided, print the named initial SID.
6165
With \fI-x\fR, print the context assigned to each displayed SID.
@@ -86,6 +90,18 @@ There is no expanded information for this component.
8690
.IP "--all"
8791
Print all components.
8892

93+
.IP "\fB Xen Component Queries: \fR"
94+
.IP "--ioportcon"
95+
Print all ioportcon statements.
96+
.IP "--iomemcon"
97+
Print all iomemcon statements.
98+
.IP "--pcidevicecon"
99+
Print all pcidevicecon statements.
100+
.IP "--pirqcon"
101+
Print all pirqcon statements.
102+
.IP "--devicetreecon"
103+
Print all devicetreecon statements.
104+
89105
.SH OPTIONS
90106
.IP "-x, --expand"
91107
Print additional details for each component matching the expression.
@@ -101,6 +117,15 @@ Print additional informational messages.
101117
.IP "--debug"
102118
Enable debugging output.
103119

120+
.SH EXAMPLE
121+
.nf
122+
List aliases of and attributes assigned to type httpd_t
123+
# seinfo -t httpd_t -x
124+
List all executable types (all types assigned to "exec_type" attribute)
125+
# seinfo -a exec_type -x
126+
List all constrains and mlsconstrains for class "file"
127+
# seinfo --constrain file
128+
104129
.SH AUTHOR
105130
Chris PeBenito <[email protected]>
106131

‎man/seinfoflow.1‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,17 +50,28 @@ Specify the maximum number of information flows to output. The default is unlimi
5050
A space-separated list of types to exclude from the analysis.
5151

5252
.SS General Options
53+
.IP "-r, --reverse"
54+
Display information flows into the source type. No effect if a target type is specified.
5355
.IP "--stats"
5456
Print information flow graph statistics at the end of the analysis.
5557
.IP "-h, --help"
5658
Print help information and exit.
59+
.IP "--full"
60+
Print full rule lists for information flows.
5761
.IP "--version"
5862
Print version information and exit.
5963
.IP "-v, --verbose"
6064
Print additional informational messages.
6165
.IP "--debug"
6266
Enable debugging output.
6367

68+
.SH EXAMPLE
69+
.nf
70+
Show the shortest paths for process running as httpd_t to access user home files, using the default permission map:
71+
# seinfoflow -s httpd_t -t user_home_t -S
72+
List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled
73+
# seinfoflow -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true"
74+
6475
.SH AUTHOR
6576
Chris PeBenito <[email protected]>
6677

‎man/sesearch.1‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ Find type_change rules.
4848
Find role allow rules.
4949
.IP "--role_trans"
5050
Find role_transition rules.
51+
.IP "Note: TE/MLS rule searches cannot be mixed with RBAC rule searches"
5152

5253
.SS MLS Rule Types
5354
.IP "--range_trans"
@@ -80,6 +81,8 @@ A matching rule must have the specified target attribute/type/role explicitly, i
8081
A matching rule must have all specified Booleans, instead of matching any of the specified Boolean.
8182
.IP "-ep"
8283
A matching rule must have exactly the specified permissions, instead of matching any of the specified permission.
84+
.IP "-ex"
85+
A matching rule must have exactly the specified extended permissions, instead of matching any listed extended permission.
8386
.IP "-Sp"
8487
A matching rule must have permissions where are a superset of the specified permissions, instead of matching any of the permissions.
8588
.IP "-rs"
@@ -103,6 +106,15 @@ Print additional informational messages.
103106
.IP "--debug"
104107
Enable debugging output.
105108

109+
.SH EXAMPLE
110+
.nf
111+
List allow (and allowxperm) rules for accessing files labeled container_file_t from domains with attribute container_domain
112+
# sesearch -A -s container_domain -t container_file_t -c file
113+
List allow and dontaudit rules for accessing chr_files labeled container_file_t, that are controlled by boolean container_use_devices
114+
# sesearch -A --dontaudit -t container_file_t -c chr_file -b container_use_devices
115+
List dontaudit rules assigned via application_domain_type attribute (rules concerning specific types with that attribute are excluded)
116+
# sesearch --dontaudit -s application_domain_type -ds
117+
106118
.SH AUTHOR
107119
Chris PeBenito <[email protected]>
108120

‎sediff‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ comp.add_argument("--level", action="store_true", help="Print MLS level definiti
4545
terule = parser.add_argument_group("type enforcement rule differences")
4646
terule.add_argument("-A", action="store_true", help="Print allow and allowxperm rule differences")
4747
terule.add_argument("--allow", action="store_true", help="Print allow rule differences")
48-
terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences")
48+
# terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences")
4949
terule.add_argument("--auditallow", action="store_true", help="Print auditallow rule differences")
5050
terule.add_argument("--dontaudit", action="store_true", help="Print dontaudit rule differences")
5151
terule.add_argument("--allowxperm", action="store_true", help="Print allowxperm rule differences")
52-
terule.add_argument("--neverallowxperm", action="store_true",
53-
help="Print neverallowxperm rule differences")
52+
# terule.add_argument("--neverallowxperm", action="store_true",
53+
# help="Print neverallowxperm rule differences")
5454
terule.add_argument("--auditallowxperm", action="store_true",
5555
help="Print auditallowxperm rule differences")
5656
terule.add_argument("--dontauditxperm", action="store_true",
@@ -97,6 +97,10 @@ other.add_argument("--typebounds", action="store_true", help="Print typebounds d
9797

9898
args = parser.parse_args()
9999

100+
# neverallow and neverallowxperm options are disabled
101+
args.neverallow = False
102+
args.neverallowxperm = False
103+
100104
if args.A:
101105
args.allow = True
102106
args.allowxperm = True

0 commit comments

Comments
 (0)