summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJoe MacDonald <joe_macdonald@mentor.com>2014-09-28 22:34:09 -0400
committerJoe MacDonald <joe_macdonald@mentor.com>2014-11-01 11:45:31 -0400
commit713359e1b8f6794357edc280a826528a3811bcee (patch)
treeb0a0cbfc7bdd3c76275891603a2989d47f0c70b0
parent981b18429013999e405b889bdecd59837ee2d6d3 (diff)
downloadmeta-selinux-713359e1b8f6794357edc280a826528a3811bcee.tar.gz
userspace: update core selinux userspace tools
Update to the latest stable release, 20140506. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Diffstat
-rw-r--r--recipes-security/selinux/checkpolicy.inc2
-rw-r--r--recipes-security/selinux/checkpolicy_2.2.bb9
-rw-r--r--recipes-security/selinux/checkpolicy_2.3.bb7
-rw-r--r--recipes-security/selinux/libselinux_2.3.bb (renamed from recipes-security/selinux/libselinux_2.2.2.bb)8
-rw-r--r--recipes-security/selinux/libsemanage_2.3.bb (renamed from recipes-security/selinux/libsemanage_2.2.bb)8
-rw-r--r--recipes-security/selinux/libsepol_2.2.bb9
-rw-r--r--recipes-security/selinux/libsepol_2.3.bb7
-rw-r--r--recipes-security/selinux/policycoreutils.inc2
-rw-r--r--recipes-security/selinux/policycoreutils_2.3.bb (renamed from recipes-security/selinux/policycoreutils_2.2.5.bb)8
-rw-r--r--recipes-security/selinux/selinux_20140506.inc (renamed from recipes-security/selinux/selinux_20131030.inc)0
-rw-r--r--recipes-security/selinux/selinux_git.inc2
-rw-r--r--recipes-security/selinux/sepolgen_1.2.1.bb4
-rw-r--r--recipes-security/setools/setools/setools-Changes-to-support-named-file_trans-rules.patch1511
-rw-r--r--recipes-security/setools/setools/setools-replcon-correct-invalid-prototype-for-lsetfilecon_ra.patch34
-rw-r--r--recipes-security/setools/setools_3.3.8.bb3
15 files changed, 63 insertions, 1551 deletions
diff --git a/recipes-security/selinux/checkpolicy.inc b/recipes-security/selinux/checkpolicy.inc
index e0c7377..1a21680 100644
--- a/recipes-security/selinux/checkpolicy.inc
+++ b/recipes-security/selinux/checkpolicy.inc
@@ -11,7 +11,7 @@ LICENSE = "GPLv2+"
11 11
12DEPENDS += "libsepol libselinux bison-native flex-native" 12DEPENDS += "libsepol libselinux bison-native flex-native"
13 13
14SRC_URI += "file://checkpolicy-Do-not-link-against-libfl.patch" 14#SRC_URI += "file://checkpolicy-Do-not-link-against-libfl.patch"
15 15
16EXTRA_OEMAKE += "PREFIX=${D}" 16EXTRA_OEMAKE += "PREFIX=${D}"
17EXTRA_OEMAKE += "LEX='flex'" 17EXTRA_OEMAKE += "LEX='flex'"
diff --git a/recipes-security/selinux/checkpolicy_2.2.bb b/recipes-security/selinux/checkpolicy_2.2.bb
deleted file mode 100644
index 23d57c1..0000000
--- a/recipes-security/selinux/checkpolicy_2.2.bb
+++ /dev/null
@@ -1,9 +0,0 @@
1PR = "r99"
2
3include selinux_20131030.inc
4include ${BPN}.inc
5
6LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833"
7
8SRC_URI[md5sum] = "d76d5c70cd594fdb15f8d319c6536324"
9SRC_URI[sha256sum] = "5d74075379cbaf17135c2a113a3053bd2e7b2a2c54ac04458de652457306c020"
diff --git a/recipes-security/selinux/checkpolicy_2.3.bb b/recipes-security/selinux/checkpolicy_2.3.bb
new file mode 100644
index 0000000..9f68487
--- /dev/null
+++ b/recipes-security/selinux/checkpolicy_2.3.bb
@@ -0,0 +1,7 @@
1include selinux_20140506.inc
2include ${BPN}.inc
3
4LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833"
5
6SRC_URI[md5sum] = "920f1a048b6023a22e1bae7b40fd413c"
7SRC_URI[sha256sum] = "8072c12121613ba943417bbb6d33224d12373ea19d75c5acd1846a35e0e05b74"
diff --git a/recipes-security/selinux/libselinux_2.2.2.bb b/recipes-security/selinux/libselinux_2.3.bb
index d6502ad..81e599d 100644
--- a/recipes-security/selinux/libselinux_2.2.2.bb
+++ b/recipes-security/selinux/libselinux_2.3.bb
@@ -1,12 +1,10 @@
1PR = "r99" 1include selinux_20140506.inc
2
3include selinux_20131030.inc
4include ${BPN}.inc 2include ${BPN}.inc
5 3
6LIC_FILES_CHKSUM = "file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0" 4LIC_FILES_CHKSUM = "file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0"
7 5
8SRC_URI[md5sum] = "c13ea5de171f21fee399abfd4aef9481" 6SRC_URI[md5sum] = "d27e249ad8450e7182203134cf4d85e2"
9SRC_URI[sha256sum] = "cc8354d67d7bef11fb2a03d23e788c6f4e8510b6760c3778dc7baf6dcfa97539" 7SRC_URI[sha256sum] = "03fe2baa7ceeea531a64fd321b44ecf09a55f3af5ef66a58a4135944f34e9851"
10 8
11SRC_URI += "\ 9SRC_URI += "\
12 file://libselinux-drop-Wno-unused-but-set-variable.patch \ 10 file://libselinux-drop-Wno-unused-but-set-variable.patch \
diff --git a/recipes-security/selinux/libsemanage_2.2.bb b/recipes-security/selinux/libsemanage_2.3.bb
index 1f00d07..5eada94 100644
--- a/recipes-security/selinux/libsemanage_2.2.bb
+++ b/recipes-security/selinux/libsemanage_2.3.bb
@@ -1,12 +1,10 @@
1PR = "r99" 1include selinux_20140506.inc
2
3include selinux_20131030.inc
4include ${BPN}.inc 2include ${BPN}.inc
5 3
6LIC_FILES_CHKSUM = "file://COPYING;md5=a6f89e2100d9b6cdffcea4f398e37343" 4LIC_FILES_CHKSUM = "file://COPYING;md5=a6f89e2100d9b6cdffcea4f398e37343"
7 5
8SRC_URI[md5sum] = "2bb8f4b728a5667519764297b7725c19" 6SRC_URI[md5sum] = "cc313b400637d94e3a549bf77555d8c3"
9SRC_URI[sha256sum] = "9b421ce1df10594cb467eef37faeb403d5c6b341a4b7e4b407ac4cb77df95cba" 7SRC_URI[sha256sum] = "4c984379a98ee9f05b80ff6e57dd2de886273d7136146456cabdce21ac32ed7f"
10 8
11SRC_URI += "\ 9SRC_URI += "\
12 file://libsemanage-Fix-execve-segfaults-on-Ubuntu.patch \ 10 file://libsemanage-Fix-execve-segfaults-on-Ubuntu.patch \
diff --git a/recipes-security/selinux/libsepol_2.2.bb b/recipes-security/selinux/libsepol_2.2.bb
deleted file mode 100644
index a0b7df7..0000000
--- a/recipes-security/selinux/libsepol_2.2.bb
+++ /dev/null
@@ -1,9 +0,0 @@
1PR = "r99"
2
3include selinux_20131030.inc
4include ${BPN}.inc
5
6LIC_FILES_CHKSUM = "file://COPYING;md5=a6f89e2100d9b6cdffcea4f398e37343"
7
8SRC_URI[md5sum] = "2d43599ed29fea9ef41218ec9635ef64"
9SRC_URI[sha256sum] = "fbd77459fd03979a9020289b10c89a0af56a52bcd0f7ae0a78455713bb04878b"
diff --git a/recipes-security/selinux/libsepol_2.3.bb b/recipes-security/selinux/libsepol_2.3.bb
new file mode 100644
index 0000000..0c07d41
--- /dev/null
+++ b/recipes-security/selinux/libsepol_2.3.bb
@@ -0,0 +1,7 @@
1include selinux_20140506.inc
2include ${BPN}.inc
3
4LIC_FILES_CHKSUM = "file://COPYING;md5=a6f89e2100d9b6cdffcea4f398e37343"
5
6SRC_URI[md5sum] = "c6b3dc07bf19ab4f364f21bbecb44beb"
7SRC_URI[sha256sum] = "5a4481bfd0fad6fdad1511c786d69de1fc3eddc28154eae1691e1bf4e9e505c3"
diff --git a/recipes-security/selinux/policycoreutils.inc b/recipes-security/selinux/policycoreutils.inc
index 153b688..44a5861 100644
--- a/recipes-security/selinux/policycoreutils.inc
+++ b/recipes-security/selinux/policycoreutils.inc
@@ -211,7 +211,7 @@ FILES_${PN}-setsebool += "\
211FILES_system-config-selinux = " \ 211FILES_system-config-selinux = " \
212 ${bindir}/sepolgen \ 212 ${bindir}/sepolgen \
213 ${datadir}/system-config-selinux/* \ 213 ${datadir}/system-config-selinux/* \
214 ${datadir}/icons/hicolor/24x24/apps/system-config-selinux.png \ 214 ${datadir}/icons/hicolor/ \
215 ${datadir}/polkit-1/actions/org.selinux.config.policy \ 215 ${datadir}/polkit-1/actions/org.selinux.config.policy \
216" 216"
217 217
diff --git a/recipes-security/selinux/policycoreutils_2.2.5.bb b/recipes-security/selinux/policycoreutils_2.3.bb
index 96cf354..447e6c9 100644
--- a/recipes-security/selinux/policycoreutils_2.2.5.bb
+++ b/recipes-security/selinux/policycoreutils_2.3.bb
@@ -1,12 +1,10 @@
1PR = "r99" 1include selinux_20140506.inc
2
3include selinux_20131030.inc
4include ${BPN}.inc 2include ${BPN}.inc
5 3
6LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833" 4LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833"
7 5
8SRC_URI[md5sum] = "f330a90c566c8b564858d45399ce3dd1" 6SRC_URI[md5sum] = "4f5c508e3c3867c8beb343e993d353dd"
9SRC_URI[sha256sum] = "3d2c8806742004693c2d4726abbc4f412340ee07bed407976dd8abeda09a4333" 7SRC_URI[sha256sum] = "11e8815ac13debb87897d2781381b89ec5c6c746a3d44223a493bc7ace6cc71f"
10 8
11SRC_URI += "\ 9SRC_URI += "\
12 file://policycoreutils-fix-sepolicy-install-path.patch \ 10 file://policycoreutils-fix-sepolicy-install-path.patch \
diff --git a/recipes-security/selinux/selinux_20131030.inc b/recipes-security/selinux/selinux_20140506.inc
index 01cc52f..01cc52f 100644
--- a/recipes-security/selinux/selinux_20131030.inc
+++ b/recipes-security/selinux/selinux_20140506.inc
diff --git a/recipes-security/selinux/selinux_git.inc b/recipes-security/selinux/selinux_git.inc
index d56f25b..6112d7d 100644
--- a/recipes-security/selinux/selinux_git.inc
+++ b/recipes-security/selinux/selinux_git.inc
@@ -1,6 +1,6 @@
1SRCREV = "edc2e99687b050d5be21a78a66d038aa1fc068d9" 1SRCREV = "edc2e99687b050d5be21a78a66d038aa1fc068d9"
2 2
3SRC_URI = "git://oss.tresys.com/git/selinux.git;protocol=http" 3SRC_URI = "git://github.com/SELinuxProject/selinux.git;protocol=http"
4 4
5include selinux_common.inc 5include selinux_common.inc
6 6
diff --git a/recipes-security/selinux/sepolgen_1.2.1.bb b/recipes-security/selinux/sepolgen_1.2.1.bb
index 21dff41..b47ff26 100644
--- a/recipes-security/selinux/sepolgen_1.2.1.bb
+++ b/recipes-security/selinux/sepolgen_1.2.1.bb
@@ -1,6 +1,4 @@
1PR = "r99" 1include selinux_20140506.inc
2
3include selinux_20131030.inc
4include ${BPN}.inc 2include ${BPN}.inc
5 3
6LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833" 4LIC_FILES_CHKSUM = "file://COPYING;md5=393a5ca445f6965873eca0259a17f833"
diff --git a/recipes-security/setools/setools/setools-Changes-to-support-named-file_trans-rules.patch b/recipes-security/setools/setools/setools-Changes-to-support-named-file_trans-rules.patch
deleted file mode 100644
index d44ae21..0000000
--- a/recipes-security/setools/setools/setools-Changes-to-support-named-file_trans-rules.patch
+++ /dev/null
@@ -1,1511 +0,0 @@
1From e0f74aa934140ccc6f5a51aa2df6fd19f0c0ee08 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Wed, 7 Mar 2012 11:00:19 +0800
4Subject: [PATCH 5/7] setools: Changes to support named file_trans rules
5
6Integrated from Fedora:
7https://community.dev.fedoraproject.org/packages/setools/sources/patches/
8---
9 libapol/include/apol/Makefile.am | 1 +
10 libapol/include/apol/ftrule-query.h | 198 +++++++++++++++++++
11 libapol/include/apol/policy-query.h | 1 +
12 libapol/src/Makefile.am | 1 +
13 libapol/src/ftrule-query.c | 363 +++++++++++++++++++++++++++++++++++
14 libapol/src/libapol.map | 1 +
15 libqpol/include/qpol/Makefile.am | 1 +
16 libqpol/include/qpol/ftrule_query.h | 116 +++++++++++
17 libqpol/include/qpol/policy.h | 1 +
18 libqpol/src/Makefile.am | 1 +
19 libqpol/src/ftrule_query.c | 277 ++++++++++++++++++++++++++
20 libqpol/src/libqpol.map | 1 +
21 libqpol/src/module_compiler.c | 12 ++
22 libqpol/src/policy_define.c | 186 ++++++++++++++++++-
23 libqpol/src/policy_parse.y | 13 +-
24 libqpol/src/policy_scan.l | 1 +
25 secmds/sesearch.c | 101 ++++++++++
26 17 files changed, 1272 insertions(+), 3 deletions(-)
27 create mode 100644 libapol/include/apol/ftrule-query.h
28 create mode 100644 libapol/src/ftrule-query.c
29 create mode 100644 libqpol/include/qpol/ftrule_query.h
30 create mode 100644 libqpol/src/ftrule_query.c
31
32diff --git a/libapol/include/apol/Makefile.am b/libapol/include/apol/Makefile.am
33index 0883c10..e398ff2 100644
34--- a/libapol/include/apol/Makefile.am
35+++ b/libapol/include/apol/Makefile.am
36@@ -27,6 +27,7 @@ apol_HEADERS = \
37 relabel-analysis.h \
38 render.h \
39 role-query.h \
40+ ftrule-query.h \
41 terule-query.h \
42 type-query.h \
43 types-relation-analysis.h \
44diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h
45new file mode 100644
46index 0000000..119c52f
47--- /dev/null
48+++ b/libapol/include/apol/ftrule-query.h
49@@ -0,0 +1,198 @@
50+/**
51+ * @file
52+ *
53+ * Routines to query filename_transition rules of a
54+ * policy.
55+ *
56+ * @author Jeremy A. Mowery jmowery@tresys.com
57+ * @author Jason Tang jtang@tresys.com
58+ *
59+ * Copyright (C) 2006-2007 Tresys Technology, LLC
60+ *
61+ * This library is free software; you can redistribute it and/or
62+ * modify it under the terms of the GNU Lesser General Public
63+ * License as published by the Free Software Foundation; either
64+ * version 2.1 of the License, or (at your option) any later version.
65+ *
66+ * This library is distributed in the hope that it will be useful,
67+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
68+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
69+ * Lesser General Public License for more details.
70+ *
71+ * You should have received a copy of the GNU Lesser General Public
72+ * License along with this library; if not, write to the Free Software
73+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
74+ */
75+
76+#ifndef APOL_FILENAMERULE_QUERY_H
77+#define APOL_FILENAMERULE_QUERY_H
78+
79+#ifdef __cplusplus
80+extern "C"
81+{
82+#endif
83+
84+#include "policy.h"
85+#include "vector.h"
86+#include <qpol/policy.h>
87+
88+ typedef struct apol_filename_trans_query apol_filename_trans_query_t;
89+
90+
91+/******************** filename_transition queries ********************/
92+
93+/**
94+ * Execute a query against all filename_transition rules within the
95+ * policy.
96+ *
97+ * @param p Policy within which to look up filename_transition rules.
98+ * @param r Structure containing parameters for query. If this is
99+ * NULL then return all filename_transition rules.
100+ * @param v Reference to a vector of qpol_filename_trans_t. The vector
101+ * will be allocated by this function. The caller must call
102+ * apol_vector_destroy() afterwards. This will be set to NULL upon no
103+ * results or upon error.
104+ *
105+ * @return 0 on success (including none found), negative on error.
106+ */
107+ extern int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * r, apol_vector_t ** v);
108+
109+/**
110+ * Allocate and return a new filename trans query structure. All fields
111+ * are initialized, such that running this blank query results in
112+ * returning all filename_transitions within the policy. The caller must
113+ * call apol_filename_trans_query_destroy() upon the return value
114+ * afterwards.
115+ *
116+ * @return An initialized filename trans query structure, or NULL upon
117+ * error.
118+ */
119+ extern apol_filename_trans_query_t *apol_filename_trans_query_create(void);
120+
121+/**
122+ * Deallocate all memory associated with the referenced filename trans
123+ * query, and then set it to NULL. This function does nothing if the
124+ * query is already NULL.
125+ *
126+ * @param r Reference to a filename trans query structure to destroy.
127+ */
128+ extern void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r);
129+
130+/**
131+ * Set a filename_trans query to return rules whose source symbol matches
132+ * symbol. Symbol may be a type or attribute; if it is an alias then
133+ * the query will convert it to its primary prior to searching. If
134+ * is_indirect is non-zero then the search will be done indirectly.
135+ * If the symbol is a type, then the query matches rules with one of
136+ * the type's attributes. If the symbol is an attribute, then it
137+ * matches rule with any of the attribute's types.
138+ *
139+ * @param p Policy handler, to report errors.
140+ * @param t TE rule query to set.
141+ * @param symbol Limit query to rules with this symbol as their
142+ * source, or NULL to unset this field.
143+ * @param is_indirect If non-zero, perform indirect matching.
144+ *
145+ * @return 0 on success, negative on error.
146+ */
147+ extern int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol,
148+ int is_indirect);
149+
150+/**
151+ * Set a filename trans query to return rules with a particular target
152+ * symbol. Symbol may be a type or attribute; if it is an alias then
153+ * the query will convert it to its primary prior to searching. If
154+ * is_indirect is non-zero then the search will be done indirectly.
155+ * If the symbol is a type, then the query matches rules with one of
156+ * the type's attributes. If the symbol is an attribute, then it
157+ * matches rule with any of the attribute's types.
158+ *
159+ * @param p Policy handler, to report errors.
160+ * @param r Role trans query to set.
161+ * @param symbol Limit query to rules with this type or attribute as
162+ * their target, or NULL to unset this field.
163+ * @param is_indirect If non-zero, perform indirect matching.
164+ *
165+ * @return 0 on success, negative on error.
166+ */
167+ extern int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *symbol,
168+ int is_indirect);
169+
170+/**
171+ * Set a filename trans query to return rules with a particular default
172+ * filename. This field is ignored if
173+ * apol_filename_trans_query_set_source_any() is set to non-zero.
174+ *
175+ * @param p Policy handler, to report errors.
176+ * @param r Role trans query to set.
177+ * @param filename Limit query to rules with this filename as their default, or
178+ * NULL to unset this field.
179+ *
180+ * @return 0 on success, negative on error.
181+ */
182+ extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename);
183+
184+/**
185+ * Set at filename_trans query to return rules with this object (non-common)
186+ * class. If more than one class are appended to the query, the
187+ * rule's class must be one of those appended. (I.e., the rule's
188+ * class must be a member of the query's classes.) Pass a NULL to
189+ * clear all classes. Note that this performs straight string
190+ * comparison, ignoring the regex flag.
191+
192+ *
193+ * @param p Policy handler, to report errors.
194+ * @param t TE rule query to set.
195+ * @param obj_class Name of object class to add to search set.
196+ *
197+ * @return 0 on success, negative on error.
198+ */
199+ extern int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class);
200+
201+/**
202+ * Set a filename trans query to treat the source filename as any. That is,
203+ * use the same symbol for either source or default of a
204+ * filename_transition rule. This flag does nothing if the source filename is
205+ * not set. Note that a filename_transition's target is a type, so thus
206+ * this flag does not affect its searching.
207+ *
208+ * @param p Policy handler, to report errors.
209+ * @param r Role trans query to set.
210+ * @param is_any Non-zero to use source symbol for source or default
211+ * field, 0 to keep source as only source.
212+ *
213+ * @return Always 0.
214+ */
215+ extern int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_any);
216+
217+/**
218+ * Set a filename trans query to use regular expression searching for
219+ * source, target, and default fields. Strings will be treated as
220+ * regexes instead of literals. For the target type, matching will
221+ * occur against the type name or any of its aliases.
222+ *
223+ * @param p Policy handler, to report errors.
224+ * @param r Role trans query to set.
225+ * @param is_regex Non-zero to enable regex searching, 0 to disable.
226+ *
227+ * @return Always 0.
228+ */
229+ extern int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_regex);
230+
231+/**
232+ * Render a filename_transition rule to a string.
233+ *
234+ * @param policy Policy handler, to report errors.
235+ * @param rule The rule to render.
236+ *
237+ * @return A newly malloc()'d string representation of the rule, or NULL on
238+ * failure; if the call fails, errno will be set. The caller is responsible
239+ * for calling free() on the returned string.
240+ */
241+ extern char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * rule);
242+
243+#ifdef __cplusplus
244+}
245+#endif
246+
247+#endif
248diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h
249index 315f70e..665e4cb 100644
250--- a/libapol/include/apol/policy-query.h
251+++ b/libapol/include/apol/policy-query.h
252@@ -71,6 +71,7 @@ extern "C"
253 #include "terule-query.h"
254 #include "condrule-query.h"
255 #include "rbacrule-query.h"
256+#include "ftrule-query.h"
257 #include "range_trans-query.h"
258 #include "constraint-query.h"
259
260diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am
261index 3fa4f06..baaa4f6 100644
262--- a/libapol/src/Makefile.am
263+++ b/libapol/src/Makefile.am
264@@ -40,6 +40,7 @@ libapol_a_SOURCES = \
265 render.c \
266 role-query.c \
267 terule-query.c \
268+ ftrule-query.c \
269 type-query.c \
270 types-relation-analysis.c \
271 user-query.c \
272diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c
273new file mode 100644
274index 0000000..dc248de
275--- /dev/null
276+++ b/libapol/src/ftrule-query.c
277@@ -0,0 +1,363 @@
278+/**
279+ * @file
280+ *
281+ * Provides a way for setools to make queries about type enforcement
282+ * filename_transs within a policy. The caller obtains a query object, fills in
283+ * its parameters, and then runs the query; it obtains a vector of
284+ * results. Searches are conjunctive -- all fields of the search
285+ * query must match for a datum to be added to the results query.
286+ *
287+ * @author Jeremy A. Mowery jmowery@tresys.com
288+ * @author Jason Tang jtang@tresys.com
289+ *
290+ * Copyright (C) 2006-2007 Tresys Technology, LLC
291+ *
292+ * This library is free software; you can redistribute it and/or
293+ * modify it under the terms of the GNU Lesser General Public
294+ * License as published by the Free Software Foundation; either
295+ * version 2.1 of the License, or (at your option) any later version.
296+ *
297+ * This library is distributed in the hope that it will be useful,
298+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
299+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
300+ * Lesser General Public License for more details.
301+ *
302+ * You should have received a copy of the GNU Lesser General Public
303+ * License along with this library; if not, write to the Free Software
304+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
305+ */
306+
307+#include "policy-query-internal.h"
308+
309+#include <errno.h>
310+#include <string.h>
311+
312+struct apol_filename_trans_query
313+{
314+ char *source, *target, *default_type, *name;
315+ apol_vector_t *classes;
316+ unsigned int flags;
317+};
318+
319+
320+/******************** filename_transition queries ********************/
321+
322+int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v)
323+{
324+ apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL;
325+ int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans;
326+ char *bool_name = NULL;
327+ *v = NULL;
328+ unsigned int flags = 0;
329+ qpol_iterator_t *iter = NULL, *type_iter = NULL;
330+
331+ if (t != NULL) {
332+ flags = t->flags;
333+ is_regex = t->flags & APOL_QUERY_REGEX;
334+ if (t->source != NULL &&
335+ (source_list =
336+ apol_query_create_candidate_type_list(p, t->source, is_regex,
337+ t->flags & APOL_QUERY_SOURCE_INDIRECT,
338+ ((t->flags & (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE)) /
339+ APOL_QUERY_SOURCE_TYPE))) == NULL) {
340+ goto cleanup;
341+ }
342+
343+ if ((t->flags & APOL_QUERY_SOURCE_AS_ANY) && t->source != NULL) {
344+ default_list = target_list = source_list;
345+ source_as_any = 1;
346+ } else {
347+ if (t->target != NULL &&
348+ (target_list =
349+ apol_query_create_candidate_type_list(p, t->target, is_regex,
350+ t->flags & APOL_QUERY_TARGET_INDIRECT,
351+ ((t->
352+ flags & (APOL_QUERY_TARGET_TYPE | APOL_QUERY_TARGET_ATTRIBUTE))
353+ / APOL_QUERY_TARGET_TYPE))) == NULL) {
354+ goto cleanup;
355+ }
356+ if (t->default_type != NULL &&
357+ (default_list =
358+ apol_query_create_candidate_type_list(p, t->default_type, is_regex, 0,
359+ APOL_QUERY_SYMBOL_IS_TYPE)) == NULL) {
360+ goto cleanup;
361+ }
362+ }
363+ if (t->classes != NULL &&
364+ apol_vector_get_size(t->classes) > 0 &&
365+ (class_list = apol_query_create_candidate_class_list(p, t->classes)) == NULL) {
366+ goto cleanup;
367+ }
368+ }
369+
370+ if (qpol_policy_get_filename_trans_iter(p->p, &iter) < 0) {
371+ return -1;
372+ }
373+
374+ if ((*v = apol_vector_create(NULL)) == NULL) {
375+ ERR(p, "%s", strerror(errno));
376+ goto cleanup;
377+ }
378+
379+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
380+ qpol_filename_trans_t *filename_trans;
381+ if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) {
382+ goto cleanup;
383+ }
384+ int match_source = 0, match_target = 0, match_default = 0, match_bool = 0;
385+ size_t i;
386+
387+ if (source_list == NULL) {
388+ match_source = 1;
389+ } else {
390+ const qpol_type_t *source_type;
391+ if (qpol_filename_trans_get_source_type(p->p, filename_trans, &source_type) < 0) {
392+ goto cleanup;
393+ }
394+ if (apol_vector_get_index(source_list, source_type, NULL, NULL, &i) == 0) {
395+ match_source = 1;
396+ }
397+ }
398+
399+ /* if source did not match, but treating source symbol
400+ * as any field, then delay rejecting this filename_trans until
401+ * the target and default have been checked */
402+ if (!source_as_any && !match_source) {
403+ continue;
404+ }
405+
406+ if (target_list == NULL || (source_as_any && match_source)) {
407+ match_target = 1;
408+ } else {
409+ const qpol_type_t *target_type;
410+ if (qpol_filename_trans_get_target_type(p->p, filename_trans, &target_type) < 0) {
411+ goto cleanup;
412+ }
413+ if (apol_vector_get_index(target_list, target_type, NULL, NULL, &i) == 0) {
414+ match_target = 1;
415+ }
416+ }
417+
418+ if (!source_as_any && !match_target) {
419+ continue;
420+ }
421+
422+ if (default_list == NULL || (source_as_any && match_source) || (source_as_any && match_target)) {
423+ match_default = 1;
424+ } else {
425+ const qpol_type_t *default_type;
426+ if (qpol_filename_trans_get_default_type(p->p, filename_trans, &default_type) < 0) {
427+ goto cleanup;
428+ }
429+ if (apol_vector_get_index(default_list, default_type, NULL, NULL, &i) == 0) {
430+ match_default = 1;
431+ }
432+ }
433+
434+ if (!source_as_any && !match_default) {
435+ continue;
436+ }
437+ /* at least one thing must match if source_as_any was given */
438+ if (source_as_any && (!match_source && !match_target && !match_default)) {
439+ continue;
440+ }
441+
442+ if (class_list != NULL) {
443+ const qpol_class_t *obj_class;
444+ if (qpol_filename_trans_get_object_class(p->p, filename_trans, &obj_class) < 0) {
445+ goto cleanup;
446+ }
447+ if (apol_vector_get_index(class_list, obj_class, NULL, NULL, &i) < 0) {
448+ continue;
449+ }
450+ }
451+
452+ if (apol_vector_append(*v, filename_trans)) {
453+ ERR(p, "%s", strerror(ENOMEM));
454+ goto cleanup;
455+ }
456+ }
457+
458+ retval = 0;
459+ cleanup:
460+ if (retval != 0) {
461+ apol_vector_destroy(v);
462+ }
463+ apol_vector_destroy(&source_list);
464+ if (!source_as_any) {
465+ apol_vector_destroy(&target_list);
466+ apol_vector_destroy(&default_list);
467+ }
468+ apol_vector_destroy(&class_list);
469+ return retval;
470+}
471+
472+apol_filename_trans_query_t *apol_filename_trans_query_create(void)
473+{
474+ apol_filename_trans_query_t *t = calloc(1, sizeof(apol_filename_trans_query_t));
475+ if (t != NULL) {
476+ t->flags =
477+ (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE | APOL_QUERY_TARGET_TYPE |
478+ APOL_QUERY_TARGET_ATTRIBUTE);
479+ }
480+ return t;
481+}
482+
483+void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r)
484+{
485+ if (r != NULL && *r != NULL) {
486+ free((*r)->source);
487+ free((*r)->target);
488+ free((*r)->default_type);
489+ free((*r)->name);
490+ free(*r);
491+ *r = NULL;
492+ }
493+}
494+
495+int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect)
496+{
497+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
498+ return apol_query_set(p, &t->source, NULL, filename);
499+}
500+
501+int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect)
502+{
503+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
504+ return apol_query_set(p, &t->target, NULL, type);
505+}
506+
507+int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol)
508+{
509+ return apol_query_set(p, &t->default_type, NULL, symbol);
510+}
511+
512+int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class)
513+{
514+ char *s = NULL;
515+ if (obj_class == NULL) {
516+ apol_vector_destroy(&t->classes);
517+ } else if ((s = strdup(obj_class)) == NULL || (t->classes == NULL && (t->classes = apol_vector_create(free)) == NULL)
518+ || apol_vector_append(t->classes, s) < 0) {
519+ ERR(p, "%s", strerror(errno));
520+ free(s);
521+ return -1;
522+ }
523+ return 0;
524+}
525+
526+int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename)
527+{
528+ return apol_query_set(p, &t->name, NULL, filename);
529+}
530+
531+int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_any)
532+{
533+ return apol_query_set_flag(p, &t->flags, is_any, APOL_QUERY_SOURCE_AS_ANY);
534+}
535+
536+int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_regex)
537+{
538+ return apol_query_set_regex(p, &t->flags, is_regex);
539+}
540+
541+char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans)
542+{
543+ char *tmp = NULL;
544+ const char *tmp_name = NULL;
545+ const char *filename_trans_type_str;
546+ int error = 0;
547+ size_t tmp_sz = 0;
548+ uint32_t filename_trans_type = 0;
549+ const qpol_type_t *type = NULL;
550+ const qpol_class_t *obj_class = NULL;
551+
552+ if (!policy || !filename_trans) {
553+ ERR(policy, "%s", strerror(EINVAL));
554+ errno = EINVAL;
555+ return NULL;
556+ }
557+
558+ /* source type */
559+ if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) {
560+ error = errno;
561+ goto err;
562+ }
563+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
564+ error = errno;
565+ goto err;
566+ }
567+ if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) {
568+ error = errno;
569+ ERR(policy, "%s", strerror(error));
570+ goto err;
571+ }
572+
573+ /* target type */
574+ if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) {
575+ error = errno;
576+ goto err;
577+ }
578+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
579+ error = errno;
580+ goto err;
581+ }
582+ if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) {
583+ error = errno;
584+ ERR(policy, "%s", strerror(error));
585+ goto err;
586+ }
587+
588+ /* object class */
589+ if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) {
590+ error = errno;
591+ goto err;
592+ }
593+ if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) {
594+ error = errno;
595+ goto err;
596+ }
597+ if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) {
598+ error = errno;
599+ ERR(policy, "%s", strerror(error));
600+ goto err;
601+ }
602+
603+ /* default type */
604+ if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) {
605+ error = errno;
606+ goto err;
607+ }
608+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
609+ error = errno;
610+ goto err;
611+ }
612+ if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) {
613+ error = errno;
614+ ERR(policy, "%s", strerror(error));
615+ goto err;
616+ }
617+
618+ if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) {
619+ error = errno;
620+ goto err;
621+ }
622+
623+ if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) {
624+ error = errno;
625+ ERR(policy, "%s", strerror(error));
626+ goto err;
627+ }
628+
629+ if (apol_str_appendf(&tmp, &tmp_sz, ";")) {
630+ error = errno;
631+ ERR(policy, "%s", strerror(error));
632+ goto err;
633+ }
634+ return tmp;
635+
636+ err:
637+ free(tmp);
638+ errno = error;
639+ return NULL;
640+}
641diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map
642index 4894374..7657a2d 100644
643--- a/libapol/src/libapol.map
644+++ b/libapol/src/libapol.map
645@@ -34,6 +34,7 @@ VERS_4.0{
646 apol_protocol_to_str;
647 apol_qpol_context_render;
648 apol_range_trans_*;
649+ apol_filename_trans_*;
650 apol_relabel_*;
651 apol_role_*;
652 apol_role_allow_*;
653diff --git a/libqpol/include/qpol/Makefile.am b/libqpol/include/qpol/Makefile.am
654index b55acb7..9b570e1 100644
655--- a/libqpol/include/qpol/Makefile.am
656+++ b/libqpol/include/qpol/Makefile.am
657@@ -25,6 +25,7 @@ qpol_HEADERS = \
658 role_query.h \
659 syn_rule_query.h \
660 terule_query.h \
661+ ftrule_query.h \
662 type_query.h \
663 user_query.h \
664 util.h
665diff --git a/libqpol/include/qpol/ftrule_query.h b/libqpol/include/qpol/ftrule_query.h
666new file mode 100644
667index 0000000..1f533a4
668--- /dev/null
669+++ b/libqpol/include/qpol/ftrule_query.h
670@@ -0,0 +1,116 @@
671+/**
672+ * @file
673+ * Defines public interface for iterating over FTRULE rules.
674+ *
675+ * @author Kevin Carr kcarr@tresys.com
676+ * @author Jeremy A. Mowery jmowery@tresys.com
677+ * @author Jason Tang jtang@tresys.com
678+ *
679+ * Copyright (C) 2006-2007 Tresys Technology, LLC
680+ *
681+ * This library is free software; you can redistribute it and/or
682+ * modify it under the terms of the GNU Lesser General Public
683+ * License as published by the Free Software Foundation; either
684+ * version 2.1 of the License, or (at your option) any later version.
685+ *
686+ * This library is distributed in the hope that it will be useful,
687+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
688+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
689+ * Lesser General Public License for more details.
690+ *
691+ * You should have received a copy of the GNU Lesser General Public
692+ * License along with this library; if not, write to the Free Software
693+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
694+ */
695+
696+#ifndef QPOL_FTRULERULE_QUERY
697+#define QPOL_FTRULERULE_QUERY
698+
699+#ifdef __cplusplus
700+extern "C"
701+{
702+#endif
703+
704+#include <qpol/policy.h>
705+#include <qpol/iterator.h>
706+
707+ typedef struct qpol_filename_trans qpol_filename_trans_t;
708+
709+/**
710+ * Get an iterator over all filename transition rules in the policy.
711+ * @param policy Policy from which to create the iterator.
712+ * @param iter Iterator over items of type qpol_filename_trans_t returned.
713+ * The caller is responsible for calling qpol_iterator_destroy()
714+ * to free memory used by this iterator.
715+ * It is important to note that this iterator is only valid as long as
716+ * the policy is unmodifed.
717+ * @returm 0 on success and < 0 on failure; if the call fails,
718+ * errno will be set and *iter will be NULL.
719+ */
720+ extern int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter);
721+
722+/**
723+ * Get the source type from a filename transition rule.
724+ * @param policy The policy from which the rule comes.
725+ * @param rule The rule from which to get the source type.
726+ * @param source Pointer in which to store the source type.
727+ * The caller should not free this pointer.
728+ * @return 0 on success and < 0 on failure; if the call fails,
729+ * errno will be set and *source will be NULL.
730+ */
731+ extern int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
732+ const qpol_type_t ** source);
733+
734+/**
735+ * Get the target type from a filename transition rule.
736+ * @param policy The policy from which the rule comes.
737+ * @param rule The rule from which to get the target type.
738+ * @param target Pointer in which to store the target type.
739+ * The caller should not free this pointer.
740+ * @return 0 on success and < 0 on failure; if the call fails,
741+ * errno will be set and *target will be NULL.
742+ */
743+ extern int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
744+ const qpol_type_t ** target);
745+
746+/**
747+ * Get the default type from a type rule.
748+ * @param policy Policy from which the rule comes.
749+ * @param rule The rule from which to get the default type.
750+ * @param dflt Pointer in which to store the default type.
751+ * The caller should not free this pointer.
752+ * @returm 0 on success and < 0 on failure; if the call fails,
753+ * errno will be set and *dflt will be NULL.
754+ */
755+ extern int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
756+ const qpol_type_t ** dflt);
757+
758+/**
759+ * Get the object class from a type rule.
760+ * @param policy Policy from which the rule comes.
761+ * @param rule The rule from which to get the object class.
762+ * @param obj_class Pointer in which to store the object class.
763+ * The caller should not free this pointer.
764+ * @returm 0 on success and < 0 on failure; if the call fails,
765+ * errno will be set and *obj_class will be NULL.
766+ */
767+ extern int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
768+ const qpol_class_t ** obj_class);
769+
770+/**
771+ * Get the transition filename type from a type rule.
772+ * @param policy Policy from which the rule comes.
773+ * @param rule The rule from which to get the transition filename.
774+ * @param target Pointer in which to store the transition filename.
775+ * The caller should not free this pointer.
776+ * @returm 0 on success and < 0 on failure; if the call fails,
777+ * errno will be set and *target will be NULL.
778+ */
779+ extern int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
780+ const char ** name);
781+
782+#ifdef __cplusplus
783+}
784+#endif
785+
786+#endif /* QPOL_FTRULERULE_QUERY */
787diff --git a/libqpol/include/qpol/policy.h b/libqpol/include/qpol/policy.h
788index ae4ea08..bf85718 100644
789--- a/libqpol/include/qpol/policy.h
790+++ b/libqpol/include/qpol/policy.h
791@@ -55,6 +55,7 @@ extern "C"
792 #include <qpol/polcap_query.h>
793 #include <qpol/portcon_query.h>
794 #include <qpol/rbacrule_query.h>
795+#include <qpol/ftrule_query.h>
796 #include <qpol/role_query.h>
797 #include <qpol/syn_rule_query.h>
798 #include <qpol/terule_query.h>
799diff --git a/libqpol/src/Makefile.am b/libqpol/src/Makefile.am
800index 34d87a6..0889a61 100644
801--- a/libqpol/src/Makefile.am
802+++ b/libqpol/src/Makefile.am
803@@ -48,6 +48,7 @@ libqpol_a_SOURCES = \
804 syn_rule_internal.h \
805 syn_rule_query.c \
806 terule_query.c \
807+ ftrule_query.c \
808 type_query.c \
809 user_query.c \
810 util.c \
811diff --git a/libqpol/src/ftrule_query.c b/libqpol/src/ftrule_query.c
812new file mode 100644
813index 0000000..d6db848
814--- /dev/null
815+++ b/libqpol/src/ftrule_query.c
816@@ -0,0 +1,277 @@
817+/**
818+ * @file
819+ * Defines public interface for iterating over RBAC rules.
820+ *
821+ * @author Jeremy A. Mowery jmowery@tresys.com
822+ * @author Jason Tang jtang@tresys.com
823+ *
824+ * Copyright (C) 2006-2007 Tresys Technology, LLC
825+ *
826+ * This library is free software; you can redistribute it and/or
827+ * modify it under the terms of the GNU Lesser General Public
828+ * License as published by the Free Software Foundation; either
829+ * version 2.1 of the License, or (at your option) any later version.
830+ *
831+ * This library is distributed in the hope that it will be useful,
832+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
833+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
834+ * Lesser General Public License for more details.
835+ *
836+ * You should have received a copy of the GNU Lesser General Public
837+ * License along with this library; if not, write to the Free Software
838+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
839+ */
840+
841+#include <qpol/iterator.h>
842+#include <qpol/policy.h>
843+#include <qpol/ftrule_query.h>
844+#include <stdlib.h>
845+#include "iterator_internal.h"
846+#include "qpol_internal.h"
847+#include <sepol/policydb/policydb.h>
848+
849+typedef struct filename_trans_state
850+{
851+ filename_trans_t *head;
852+ filename_trans_t *cur;
853+} filename_trans_state_t;
854+
855+static int filename_trans_state_end(const qpol_iterator_t * iter)
856+{
857+ filename_trans_state_t *fts = NULL;
858+
859+ if (!iter || !(fts = qpol_iterator_state(iter))) {
860+ errno = EINVAL;
861+ return STATUS_ERR;
862+ }
863+
864+ return fts->cur ? 0 : 1;
865+}
866+
867+static void *filename_trans_state_get_cur(const qpol_iterator_t * iter)
868+{
869+ filename_trans_state_t *fts = NULL;
870+ const policydb_t *db = NULL;
871+
872+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter)) || filename_trans_state_end(iter)) {
873+ errno = EINVAL;
874+ return NULL;
875+ }
876+
877+ return fts->cur;
878+}
879+
880+static int filename_trans_state_next(qpol_iterator_t * iter)
881+{
882+ filename_trans_state_t *fts = NULL;
883+ const policydb_t *db = NULL;
884+
885+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
886+ errno = EINVAL;
887+ return STATUS_ERR;
888+ }
889+
890+ if (filename_trans_state_end(iter)) {
891+ errno = ERANGE;
892+ return STATUS_ERR;
893+ }
894+
895+ fts->cur = fts->cur->next;
896+
897+ return STATUS_SUCCESS;
898+}
899+
900+static size_t filename_trans_state_size(const qpol_iterator_t * iter)
901+{
902+ filename_trans_state_t *fts = NULL;
903+ const policydb_t *db = NULL;
904+ filename_trans_t *tmp = NULL;
905+ size_t count = 0;
906+
907+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
908+ errno = EINVAL;
909+ return STATUS_ERR;
910+ }
911+
912+ for (tmp = fts->head; tmp; tmp = tmp->next)
913+ count++;
914+
915+ return count;
916+}
917+
918+int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
919+{
920+ policydb_t *db = NULL;
921+ filename_trans_state_t *fts = NULL;
922+ int error = 0;
923+
924+ if (iter)
925+ *iter = NULL;
926+
927+ if (!policy || !iter) {
928+ ERR(policy, "%s", strerror(EINVAL));
929+ errno = EINVAL;
930+ return STATUS_ERR;
931+ }
932+
933+ db = &policy->p->p;
934+
935+ fts = calloc(1, sizeof(filename_trans_state_t));
936+ if (!fts) {
937+ /* errno set by calloc */
938+ ERR(policy, "%s", strerror(errno));
939+ return STATUS_ERR;
940+ }
941+ fts->head = fts->cur = db->filename_trans;
942+
943+ if (qpol_iterator_create
944+ (policy, (void *)fts, filename_trans_state_get_cur, filename_trans_state_next, filename_trans_state_end, filename_trans_state_size,
945+ free, iter)) {
946+ error = errno;
947+ free(fts);
948+ errno = error;
949+ return STATUS_ERR;
950+ }
951+
952+ return STATUS_SUCCESS;
953+}
954+
955+int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** source)
956+{
957+ policydb_t *db = NULL;
958+ filename_trans_t *ft = NULL;
959+
960+ if (source) {
961+ *source = NULL;
962+ }
963+
964+ if (!policy || !rule || !source) {
965+ ERR(policy, "%s", strerror(EINVAL));
966+ errno = EINVAL;
967+ return STATUS_ERR;
968+ }
969+
970+ db = &policy->p->p;
971+ ft = (filename_trans_t *) rule;
972+
973+ *source = (qpol_type_t *) db->type_val_to_struct[ft->stype - 1];
974+
975+ return STATUS_SUCCESS;
976+}
977+
978+int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** target)
979+{
980+ policydb_t *db = NULL;
981+ filename_trans_t *ft = NULL;
982+
983+ if (target) {
984+ *target = NULL;
985+ }
986+
987+ if (!policy || !rule || !target) {
988+ ERR(policy, "%s", strerror(EINVAL));
989+ errno = EINVAL;
990+ return STATUS_ERR;
991+ }
992+
993+ db = &policy->p->p;
994+ ft = (filename_trans_t *) rule;
995+
996+ *target = (qpol_type_t *) db->type_val_to_struct[ft->ttype - 1];
997+
998+ return STATUS_SUCCESS;
999+}
1000+
1001+int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
1002+ const qpol_class_t ** obj_class)
1003+{
1004+ policydb_t *db = NULL;
1005+ filename_trans_t *ft = NULL;
1006+
1007+ if (obj_class) {
1008+ *obj_class = NULL;
1009+ }
1010+
1011+ if (!policy || !rule || !obj_class) {
1012+ ERR(policy, "%s", strerror(EINVAL));
1013+ errno = EINVAL;
1014+ return STATUS_ERR;
1015+ }
1016+
1017+ db = &policy->p->p;
1018+ ft = (filename_trans_t *) rule;
1019+
1020+ *obj_class = (qpol_class_t *) db->class_val_to_struct[ft->tclass - 1];
1021+
1022+ return STATUS_SUCCESS;
1023+}
1024+
1025+int qpol_filename_trans_get_trans_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** output_type)
1026+{
1027+ policydb_t *db = NULL;
1028+ filename_trans_t *ft = NULL;
1029+
1030+ if (output_type) {
1031+ *output_type = NULL;
1032+ }
1033+
1034+ if (!policy || !rule || !output_type) {
1035+ ERR(policy, "%s", strerror(EINVAL));
1036+ errno = EINVAL;
1037+ return STATUS_ERR;
1038+ }
1039+
1040+ db = &policy->p->p;
1041+ ft = (filename_trans_t *) rule;
1042+
1043+ *output_type = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
1044+
1045+ return STATUS_SUCCESS;
1046+}
1047+
1048+int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** dflt)
1049+{
1050+ policydb_t *db = NULL;
1051+ filename_trans_t *ft = NULL;
1052+
1053+ if (dflt) {
1054+ *dflt = NULL;
1055+ }
1056+
1057+ if (!policy || !rule || !dflt) {
1058+ ERR(policy, "%s", strerror(EINVAL));
1059+ errno = EINVAL;
1060+ return STATUS_ERR;
1061+ }
1062+
1063+ db = &policy->p->p;
1064+ ft = (filename_trans_t *) rule;
1065+
1066+ *dflt = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
1067+
1068+ return STATUS_SUCCESS;
1069+}
1070+
1071+int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name)
1072+{
1073+ policydb_t *db = NULL;
1074+ filename_trans_t *ft = NULL;
1075+
1076+ if (name) {
1077+ *name = NULL;
1078+ }
1079+
1080+ if (!policy || !rule || !name) {
1081+ ERR(policy, "%s", strerror(EINVAL));
1082+ errno = EINVAL;
1083+ return STATUS_ERR;
1084+ }
1085+
1086+ db = &policy->p->p;
1087+ ft = (filename_trans_t *) rule;
1088+
1089+ *name = ft->name;
1090+
1091+ return STATUS_SUCCESS;
1092+}
1093+
1094diff --git a/libqpol/src/libqpol.map b/libqpol/src/libqpol.map
1095index dd293bc..6973cca 100644
1096--- a/libqpol/src/libqpol.map
1097+++ b/libqpol/src/libqpol.map
1098@@ -34,6 +34,7 @@ VERS_1.2 {
1099 qpol_policy_reevaluate_conds;
1100 qpol_portcon_*;
1101 qpol_range_trans_*;
1102+ qpol_filename_trans_*;
1103 qpol_role_*;
1104 qpol_syn_avrule_*;
1105 qpol_syn_terule_*;
1106diff --git a/libqpol/src/module_compiler.c b/libqpol/src/module_compiler.c
1107index dc19798..b06e285 100644
1108--- a/libqpol/src/module_compiler.c
1109+++ b/libqpol/src/module_compiler.c
1110@@ -1247,6 +1247,18 @@ void append_role_allow(role_allow_rule_t * role_allow_rules)
1111 }
1112
1113 /* this doesn't actually append, but really prepends it */
1114+void append_filename_trans(filename_trans_rule_t * filename_trans_rules)
1115+{
1116+ avrule_decl_t *decl = stack_top->decl;
1117+
1118+ /* filename transitions are not allowed within conditionals */
1119+ assert(stack_top->type == 1);
1120+
1121+ filename_trans_rules->next = decl->filename_trans_rules;
1122+ decl->filename_trans_rules = filename_trans_rules;
1123+}
1124+
1125+/* this doesn't actually append, but really prepends it */
1126 void append_range_trans(range_trans_rule_t * range_tr_rules)
1127 {
1128 avrule_decl_t *decl = stack_top->decl;
1129diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c
1130index c94f7aa..0f3a45a 100644
1131--- a/libqpol/src/policy_define.c
1132+++ b/libqpol/src/policy_define.c
1133@@ -2133,7 +2133,7 @@ int define_role_trans(void)
1134
1135 /* This ebitmap business is just to ensure that there are not conflicting role_trans rules */
1136 #ifdef HAVE_SEPOL_USER_ROLE_MAPPING
1137- if (role_set_expand(&roles, &e_roles, policydbp, NULL))
1138+ if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL))
1139 #else
1140 if (role_set_expand(&roles, &e_roles, policydbp))
1141 #endif
1142@@ -2226,6 +2226,190 @@ int define_role_allow(void)
1143 return 0;
1144 }
1145
1146+avrule_t *define_cond_filename_trans(void)
1147+{
1148+ yyerror("type transitions with a filename not allowed inside "
1149+ "conditionals\n");
1150+ return COND_ERR;
1151+}
1152+
1153+int define_filename_trans(void)
1154+{
1155+ char *id, *name = NULL;
1156+ type_set_t stypes, ttypes;
1157+ ebitmap_t e_stypes, e_ttypes;
1158+ ebitmap_t e_tclasses;
1159+ ebitmap_node_t *snode, *tnode, *cnode;
1160+ filename_trans_t *ft;
1161+ filename_trans_rule_t *ftr;
1162+ class_datum_t *cladatum;
1163+ type_datum_t *typdatum;
1164+ uint32_t otype;
1165+ unsigned int c, s, t;
1166+ int add;
1167+
1168+ if (pass == 1) {
1169+ /* stype */
1170+ while ((id = queue_remove(id_queue)))
1171+ free(id);
1172+ /* ttype */
1173+ while ((id = queue_remove(id_queue)))
1174+ free(id);
1175+ /* tclass */
1176+ while ((id = queue_remove(id_queue)))
1177+ free(id);
1178+ /* otype */
1179+ id = queue_remove(id_queue);
1180+ free(id);
1181+ /* name */
1182+ id = queue_remove(id_queue);
1183+ free(id);
1184+ return 0;
1185+ }
1186+
1187+
1188+ add = 1;
1189+ type_set_init(&stypes);
1190+ while ((id = queue_remove(id_queue))) {
1191+ if (set_types(&stypes, id, &add, 0))
1192+ goto bad;
1193+ }
1194+
1195+ add =1;
1196+ type_set_init(&ttypes);
1197+ while ((id = queue_remove(id_queue))) {
1198+ if (set_types(&ttypes, id, &add, 0))
1199+ goto bad;
1200+ }
1201+
1202+ ebitmap_init(&e_tclasses);
1203+ while ((id = queue_remove(id_queue))) {
1204+ if (!is_id_in_scope(SYM_CLASSES, id)) {
1205+ yyerror2("class %s is not within scope", id);
1206+ free(id);
1207+ goto bad;
1208+ }
1209+ cladatum = hashtab_search(policydbp->p_classes.table, id);
1210+ if (!cladatum) {
1211+ yyerror2("unknown class %s", id);
1212+ goto bad;
1213+ }
1214+ if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) {
1215+ yyerror("Out of memory");
1216+ goto bad;
1217+ }
1218+ free(id);
1219+ }
1220+
1221+ id = (char *)queue_remove(id_queue);
1222+ if (!id) {
1223+ yyerror("no otype in transition definition?");
1224+ goto bad;
1225+ }
1226+ if (!is_id_in_scope(SYM_TYPES, id)) {
1227+ yyerror2("type %s is not within scope", id);
1228+ free(id);
1229+ goto bad;
1230+ }
1231+ typdatum = hashtab_search(policydbp->p_types.table, id);
1232+ if (!typdatum) {
1233+ yyerror2("unknown type %s used in transition definition", id);
1234+ goto bad;
1235+ }
1236+ free(id);
1237+ otype = typdatum->s.value;
1238+
1239+ name = queue_remove(id_queue);
1240+ if (!name) {
1241+ yyerror("no pathname specified in filename_trans definition?");
1242+ goto bad;
1243+ }
1244+
1245+ /* We expand the class set into seperate rules. We expand the types
1246+ * just to make sure there are not duplicates. They will get turned
1247+ * into seperate rules later */
1248+ ebitmap_init(&e_stypes);
1249+ if (type_set_expand(&stypes, &e_stypes, policydbp, 1))
1250+ goto bad;
1251+
1252+ ebitmap_init(&e_ttypes);
1253+ if (type_set_expand(&ttypes, &e_ttypes, policydbp, 1))
1254+ goto bad;
1255+
1256+ ebitmap_for_each_bit(&e_tclasses, cnode, c) {
1257+ if (!ebitmap_node_get_bit(cnode, c))
1258+ continue;
1259+ ebitmap_for_each_bit(&e_stypes, snode, s) {
1260+ if (!ebitmap_node_get_bit(snode, s))
1261+ continue;
1262+ ebitmap_for_each_bit(&e_ttypes, tnode, t) {
1263+ if (!ebitmap_node_get_bit(tnode, t))
1264+ continue;
1265+
1266+ for (ft = policydbp->filename_trans; ft; ft = ft->next) {
1267+ if (ft->stype == (s + 1) &&
1268+ ft->ttype == (t + 1) &&
1269+ ft->tclass == (c + 1) &&
1270+ !strcmp(ft->name, name)) {
1271+ yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
1272+ name,
1273+ policydbp->p_type_val_to_name[s],
1274+ policydbp->p_type_val_to_name[t],
1275+ policydbp->p_class_val_to_name[c]);
1276+ goto bad;
1277+ }
1278+ }
1279+
1280+ ft = malloc(sizeof(*ft));
1281+ if (!ft) {
1282+ yyerror("out of memory");
1283+ goto bad;
1284+ }
1285+ memset(ft, 0, sizeof(*ft));
1286+
1287+ ft->next = policydbp->filename_trans;
1288+ policydbp->filename_trans = ft;
1289+
1290+ ft->name = strdup(name);
1291+ if (!ft->name) {
1292+ yyerror("out of memory");
1293+ goto bad;
1294+ }
1295+ ft->stype = s + 1;
1296+ ft->ttype = t + 1;
1297+ ft->tclass = c + 1;
1298+ ft->otype = otype;
1299+ }
1300+ }
1301+
1302+ /* Now add the real rule since we didn't find any duplicates */
1303+ ftr = malloc(sizeof(*ftr));
1304+ if (!ftr) {
1305+ yyerror("out of memory");
1306+ goto bad;
1307+ }
1308+ filename_trans_rule_init(ftr);
1309+ append_filename_trans(ftr);
1310+
1311+ ftr->name = strdup(name);
1312+ ftr->stypes = stypes;
1313+ ftr->ttypes = ttypes;
1314+ ftr->tclass = c + 1;
1315+ ftr->otype = otype;
1316+ }
1317+
1318+ free(name);
1319+ ebitmap_destroy(&e_stypes);
1320+ ebitmap_destroy(&e_ttypes);
1321+ ebitmap_destroy(&e_tclasses);
1322+
1323+ return 0;
1324+
1325+bad:
1326+ free(name);
1327+ return -1;
1328+}
1329+
1330 static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr)
1331 {
1332 constraint_expr_t *h = NULL, *l = NULL, *e, *newe;
1333diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y
1334index 84f4114..dc16c6f 100644
1335--- a/libqpol/src/policy_parse.y
1336+++ b/libqpol/src/policy_parse.y
1337@@ -98,6 +98,7 @@ extern char *qpol_src_inputlim;/* end of data */
1338 %type <require_func> require_decl_def
1339
1340 %token PATH
1341+%token FILENAME
1342 %token CLONE
1343 %token COMMON
1344 %token CLASS
1345@@ -360,7 +361,10 @@ cond_rule_def : cond_transition_def
1346 | require_block
1347 { $$ = NULL; }
1348 ;
1349-cond_transition_def : TYPE_TRANSITION names names ':' names identifier ';'
1350+cond_transition_def : TYPE_TRANSITION names names ':' names identifier filename ';'
1351+ { $$ = define_cond_filename_trans() ;
1352+ if ($$ == COND_ERR) return -1;}
1353+ | TYPE_TRANSITION names names ':' names identifier ';'
1354 { $$ = define_cond_compute_type(AVRULE_TRANSITION) ;
1355 if ($$ == COND_ERR) return -1;}
1356 | TYPE_MEMBER names names ':' names identifier ';'
1357@@ -395,7 +399,9 @@ cond_dontaudit_def : DONTAUDIT names names ':' names names ';'
1358 { $$ = define_cond_te_avtab(AVRULE_DONTAUDIT);
1359 if ($$ == COND_ERR) return -1; }
1360 ;
1361-transition_def : TYPE_TRANSITION names names ':' names identifier ';'
1362+transition_def : TYPE_TRANSITION names names ':' names identifier filename ';'
1363+ {if (define_filename_trans()) return -1; }
1364+ | TYPE_TRANSITION names names ':' names identifier ';'
1365 {if (define_compute_type(AVRULE_TRANSITION)) return -1;}
1366 | TYPE_MEMBER names names ':' names identifier ';'
1367 {if (define_compute_type(AVRULE_MEMBER)) return -1;}
1368@@ -752,6 +758,9 @@ identifier : IDENTIFIER
1369 path : PATH
1370 { if (insert_id(yytext,0)) return -1; }
1371 ;
1372+filename : FILENAME
1373+ { yytext[strlen(yytext) - 1] = '\0'; if (insert_id(yytext + 1,0)) return -1; }
1374+ ;
1375 number : NUMBER
1376 { $$ = strtoul(yytext,NULL,0); }
1377 ;
1378diff --git a/libqpol/src/policy_scan.l b/libqpol/src/policy_scan.l
1379index 75485f3..30203cd 100644
1380--- a/libqpol/src/policy_scan.l
1381+++ b/libqpol/src/policy_scan.l
1382@@ -235,6 +235,7 @@ POLICYCAP { return(POLICYCAP); }
1383 permissive |
1384 PERMISSIVE { return(PERMISSIVE); }
1385 "/"({alnum}|[_\.\-/])* { return(PATH); }
1386+\"({alnum}|[_\.\-])+\" { return(FILENAME); }
1387 {letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))* { return(IDENTIFIER); }
1388 {digit}+|0x{hexval}+ { return(NUMBER); }
1389 {digit}{1,3}(\.{digit}{1,3}){3} { return(IPV4_ADDR); }
1390diff --git a/secmds/sesearch.c b/secmds/sesearch.c
1391index ec0315f..e44b3bc 100644
1392--- a/secmds/sesearch.c
1393+++ b/secmds/sesearch.c
1394@@ -575,6 +575,95 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt
1395 free(expr);
1396 }
1397
1398+static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
1399+{
1400+ apol_filename_trans_query_t *ftq = NULL;
1401+ int error = 0;
1402+
1403+ if (!policy || !opt || !v) {
1404+ ERR(policy, "%s", strerror(EINVAL));
1405+ errno = EINVAL;
1406+ return -1;
1407+ }
1408+
1409+ if (!opt->type == QPOL_RULE_TYPE_TRANS && !opt->all) {
1410+ *v = NULL;
1411+ return 0; /* no search to do */
1412+ }
1413+
1414+ ftq = apol_filename_trans_query_create();
1415+ if (!ftq) {
1416+ ERR(policy, "%s", strerror(ENOMEM));
1417+ errno = ENOMEM;
1418+ return -1;
1419+ }
1420+
1421+ apol_filename_trans_query_set_regex(policy, ftq, opt->useregex);
1422+ if (opt->src_name) {
1423+ if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name)) {
1424+ error = errno;
1425+ goto err;
1426+ }
1427+ }
1428+ if (opt->tgt_name) {
1429+ if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) {
1430+ error = errno;
1431+ goto err;
1432+ }
1433+ }
1434+
1435+ if (apol_filename_trans_get_by_query(policy, ftq, v)) {
1436+ error = errno;
1437+ goto err;
1438+ }
1439+
1440+ apol_filename_trans_query_destroy(&ftq);
1441+ return 0;
1442+
1443+ err:
1444+ apol_vector_destroy(v);
1445+ apol_filename_trans_query_destroy(&ftq);
1446+ ERR(policy, "%s", strerror(error));
1447+ errno = error;
1448+ return -1;
1449+}
1450+
1451+static void print_ft_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v)
1452+{
1453+ qpol_policy_t *q = apol_policy_get_qpol(policy);
1454+ size_t i, num_rules = 0;
1455+ const qpol_filename_trans_t *rule = NULL;
1456+ char *tmp = NULL, *rule_str = NULL, *expr = NULL;
1457+ char enable_char = ' ', branch_char = ' ';
1458+ qpol_iterator_t *iter = NULL;
1459+ const qpol_cond_t *cond = NULL;
1460+ uint32_t enabled = 0, list = 0;
1461+
1462+ if (!(num_rules = apol_vector_get_size(v)))
1463+ goto cleanup;
1464+
1465+ fprintf(stdout, "Found %zd named file transition rules:\n", num_rules);
1466+
1467+ for (i = 0; i < num_rules; i++) {
1468+ enable_char = branch_char = ' ';
1469+ if (!(rule = apol_vector_get_element(v, i)))
1470+ goto cleanup;
1471+
1472+ if (!(rule_str = apol_filename_trans_render(policy, rule)))
1473+ goto cleanup;
1474+ fprintf(stdout, "%s %s\n", rule_str, expr ? expr : "");
1475+ free(rule_str);
1476+ rule_str = NULL;
1477+ free(expr);
1478+ expr = NULL;
1479+ }
1480+
1481+ cleanup:
1482+ free(tmp);
1483+ free(rule_str);
1484+ free(expr);
1485+}
1486+
1487 static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
1488 {
1489 apol_role_allow_query_t *raq = NULL;
1490@@ -1128,6 +1217,18 @@ int main(int argc, char **argv)
1491 print_te_results(policy, &cmd_opts, v);
1492 fprintf(stdout, "\n");
1493 }
1494+
1495+ if (cmd_opts.all || cmd_opts.type == QPOL_RULE_TYPE_TRANS) {
1496+ apol_vector_destroy(&v);
1497+ if (perform_ft_query(policy, &cmd_opts, &v)) {
1498+ rt = 1;
1499+ goto cleanup;
1500+ }
1501+
1502+ print_ft_results(policy, &cmd_opts, v);
1503+ fprintf(stdout, "\n");
1504+ }
1505+
1506 apol_vector_destroy(&v);
1507 if (perform_ra_query(policy, &cmd_opts, &v)) {
1508 rt = 1;
1509--
15101.7.5.4
1511
diff --git a/recipes-security/setools/setools/setools-replcon-correct-invalid-prototype-for-lsetfilecon_ra.patch b/recipes-security/setools/setools/setools-replcon-correct-invalid-prototype-for-lsetfilecon_ra.patch
new file mode 100644
index 0000000..c9bacbd
--- /dev/null
+++ b/recipes-security/setools/setools/setools-replcon-correct-invalid-prototype-for-lsetfilecon_ra.patch
@@ -0,0 +1,34 @@
1From 74680dfb3df4c0c5b0e4bcf41717a9ea16fd8680 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Mon, 29 Sep 2014 14:19:48 -0400
4Subject: [PATCH] replcon: correct invalid prototype for lsetfilecon_raw
5
6Port debian patch from:
7
8 git://anonscm.debian.org/selinux/setools.git
9 commit a3ab84b35efd9c42641d53ec2236ad01f7411df7
10
11Upstream-Status: Denied [ the setools3 tree is in stasis and the focus is
12 only on setools4 now ]
13
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 secmds/replcon.cc | 2 +-
17 1 file changed, 1 insertion(+), 1 deletion(-)
18
19diff --git a/secmds/replcon.cc b/secmds/replcon.cc
20index 34f7c1a..307c39f 100644
21--- a/secmds/replcon.cc
22+++ b/secmds/replcon.cc
23@@ -60,7 +60,7 @@ static struct option const longopts[] = {
24 {NULL, 0, NULL, 0}
25 };
26
27-extern int lsetfilecon_raw(const char *, security_context_t) __attribute__ ((weak));
28+extern int lsetfilecon_raw(const char *, const char *) __attribute__ ((weak));
29
30 /**
31 * As that setools must work with older libselinux versions that may
32--
331.9.1
34
diff --git a/recipes-security/setools/setools_3.3.8.bb b/recipes-security/setools/setools_3.3.8.bb
index 6f3b1dd..050f4ff 100644
--- a/recipes-security/setools/setools_3.3.8.bb
+++ b/recipes-security/setools/setools_3.3.8.bb
@@ -14,7 +14,6 @@ SRC_URI[sha256sum] = "44387ecc9a231ec536a937783440cd8960a72c51f14bffc1604b7525e3
14 14
15SRC_URI += "file://setools-neverallow-rules-all-always-fail.patch" 15SRC_URI += "file://setools-neverallow-rules-all-always-fail.patch"
16SRC_URI += "file://setools-Fix-sepol-calls-to-work-with-latest-libsepol.patch" 16SRC_URI += "file://setools-Fix-sepol-calls-to-work-with-latest-libsepol.patch"
17#SRC_URI += "file://setools-Changes-to-support-named-file_trans-rules.patch"
18 17
19SRC_URI += "file://setools-Don-t-check-selinux-policies-if-disabled.patch" 18SRC_URI += "file://setools-Don-t-check-selinux-policies-if-disabled.patch"
20SRC_URI += "file://setools-configure-ac.patch" 19SRC_URI += "file://setools-configure-ac.patch"
@@ -23,6 +22,8 @@ SRC_URI += "file://setools-cross-ar.patch"
23SRC_URI += "file://setools-Fix-test-bug-for-unary-operator.patch" 22SRC_URI += "file://setools-Fix-test-bug-for-unary-operator.patch"
24SRC_URI += "file://setools-Fix-python-setools-Makefile.am-for-cross.patch" 23SRC_URI += "file://setools-Fix-python-setools-Makefile.am-for-cross.patch"
25 24
25SRC_URI += "file://setools-replcon-correct-invalid-prototype-for-lsetfilecon_ra.patch"
26
26LIC_FILES_CHKSUM = "file://${S}/COPYING;md5=26035c503c68ae1098177934ac0cc795 \ 27LIC_FILES_CHKSUM = "file://${S}/COPYING;md5=26035c503c68ae1098177934ac0cc795 \
27 file://${S}/COPYING.GPL;md5=751419260aa954499f7abaabaa882bbe \ 28 file://${S}/COPYING.GPL;md5=751419260aa954499f7abaabaa882bbe \
28 file://${S}/COPYING.LGPL;md5=fbc093901857fcd118f065f900982c24" 29 file://${S}/COPYING.LGPL;md5=fbc093901857fcd118f065f900982c24"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-26 02:02:36 +0000