Hello community, here is the log from the commit of package mcstrans for openSUSE:Leap:15.2 checked in at 2020-03-21 16:45:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Leap:15.2/mcstrans (Old) and /work/SRC/openSUSE:Leap:15.2/.mcstrans.new.3160 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mcstrans" Sat Mar 21 16:45:26 2020 rev:13 rq:785976 version:3.0 Changes: -------- --- /work/SRC/openSUSE:Leap:15.2/mcstrans/mcstrans.changes 2020-01-15 15:28:44.138687673 +0100 +++ /work/SRC/openSUSE:Leap:15.2/.mcstrans.new.3160/mcstrans.changes 2020-03-21 16:46:33.449610400 +0100 @@ -1,0 +2,29 @@ +Tue Mar 3 12:26:40 UTC 2020 - Johannes Segitz <[email protected]> + +- Update to version 3.0 + * Add reference to setools.conf man page in the daemon one + +------------------------------------------------------------------- +Tue Aug 27 10:25:48 UTC 2019 - Jan Engelhardt <[email protected]> + +- Avoid use of ®/™ signs in specfiles as per guidelines. + +------------------------------------------------------------------- +Wed Jun 12 15:01:20 UTC 2019 - Dominique Leuenberger <[email protected]> + +- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to + shortcut the build queues by allowing usage of systemd-mini + +------------------------------------------------------------------- +Wed Mar 20 15:14:52 UTC 2019 - [email protected] + +- Update to version 2.9 + * Fix check in raw_color() + * remove unused getpeercon_raw() call + +------------------------------------------------------------------- +Tue Dec 4 11:39:52 UTC 2018 - Jan Engelhardt <[email protected]> + +- One grammar fix, and use %make_install. + +------------------------------------------------------------------- @@ -11,0 +41,2 @@ + For changes please see + https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/RELEASE-20180524.txt @@ -17,0 +49,2 @@ + For changes please see + https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/RELEASE-20170804.txt @@ -86 +118,0 @@ - Old: ---- mcstrans-2.8.tar.gz New: ---- mcstrans-3.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mcstrans.spec ++++++ --- /var/tmp/diff_new_pack.Xr6E39/_old 2020-03-21 16:46:34.837611822 +0100 +++ /var/tmp/diff_new_pack.Xr6E39/_new 2020-03-21 16:46:34.889611876 +0100 @@ -1,7 +1,7 @@ # # spec file for package mcstrans # -# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,20 +12,18 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # -%define tstamp 20180524 - Name: mcstrans -Version: 2.8 +Version: 3.0 Release: 0 Summary: SELinux Translation Daemon License: GPL-2.0-or-later Group: System/Management URL: https://github.com/SELinuxProject/selinux/wiki -Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/%{tstamp}/%{name}-%{version}.tar.gz +Source: https://github.com/SELinuxProject/selinux/releases/download/20191204/%{name}-%{version}.tar.gz Patch0: %{name}-writepid.patch Patch1: add_includes.patch BuildRequires: aaa_base @@ -33,23 +31,23 @@ BuildRequires: libselinux-devel >= 1.30.3 BuildRequires: libsepol-devel-static BuildRequires: pcre-devel -BuildRequires: systemd +BuildRequires: pkgconfig(systemd) Requires: aaa_base Provides: setransd %{?systemd_requires} %description -Security-enhanced Linux is a feature of the Linux® kernel and a number +Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve the security of the Flask operating system. These architectural components provide general support for the enforcement of many kinds of mandatory access control policies, including those -based on the concepts of Type Enforcement®, Role-based Access +based on the concepts of Type Enforcement, Role-based Access Control, and Multi-level Security. -mcstrans provides an translation daemon to translate SELinux categories +mcstrans provides a translation daemon to translate SELinux categories from internal representations to user defined representation. %prep @@ -65,7 +63,7 @@ mkdir -p %{buildroot}/%{_lib} mkdir -p %{buildroot}/%{_libdir} mkdir -p %{buildroot}/%{_unitdir} -make DESTDIR=%{buildroot} LIBDIR="%{buildroot}%{_libdir}" SHLIBDIR="%{buildroot}/%{_lib}" install +%make_install LIBDIR="%{buildroot}%{_libdir}" SHLIBDIR="%{buildroot}/%{_lib}" rm -f %{buildroot}%{_sbindir}/* rm -f %{buildroot}%{_libdir}/*.a rm %{buildroot}%{_sysconfdir}/rc.d/init.d/mcstrans* @@ -91,9 +89,10 @@ %{_unitdir}/mcstrans*.service /sbin/mcstransd %{_sbindir}/rcmcstrans -%{_mandir}/man8/mcs.8%{?ext_man} -%{_mandir}/man8/mcstransd.8%{?ext_man} -%{_mandir}/man8/setrans.conf.8%{?ext_man} +%{_mandir}/man5/*.5%{?ext_man} +%{_mandir}/ru/man5/*.5%{?ext_man} +%{_mandir}/man8/*.8%{?ext_man} +%{_mandir}/ru/man8/*.8%{?ext_man} %dir %{_datadir}/doc/packages/%{name} %{_datadir}/doc/packages/%{name}/* ++++++ mcstrans-2.8.tar.gz -> mcstrans-3.0.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/VERSION new/mcstrans-3.0/VERSION --- old/mcstrans-2.8/VERSION 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/VERSION 2019-11-28 13:46:48.000000000 +0100 @@ -1 +1 @@ -2.8 +3.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/Makefile new/mcstrans-3.0/man/Makefile --- old/mcstrans-2.8/man/Makefile 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/man/Makefile 2019-11-28 13:46:48.000000000 +0100 @@ -1,13 +1,31 @@ # Installation directories. +LINGUAS ?= ru PREFIX ?= /usr -MAN8DIR ?= $(PREFIX)/share/man/man8 +MANDIR ?= $(PREFIX)/share/man +MAN5SUBDIR ?= man5 +MAN5DIR ?= $(MANDIR)/$(MAN5SUBDIR) +MAN8SUBDIR ?= man8 +MAN8DIR ?= $(MANDIR)/$(MAN8SUBDIR) all: install: all + mkdir -p $(DESTDIR)$(MAN5DIR) mkdir -p $(DESTDIR)$(MAN8DIR) + install -m 644 man5/*.5 $(DESTDIR)$(MAN5DIR) install -m 644 man8/*.8 $(DESTDIR)$(MAN8DIR) + for lang in $(LINGUAS) ; do \ + if [ -e $${lang}/man5 ] ; then \ + mkdir -p $(DESTDIR)$(MANDIR)/$${lang}/$(MAN5SUBDIR) ; \ + install -m 644 $${lang}/man5/*.5 $(DESTDIR)$(MANDIR)/$${lang}/$(MAN5SUBDIR) ; \ + fi ; \ + if [ -e $${lang}/man8 ] ; then \ + mkdir -p $(DESTDIR)$(MANDIR)/$${lang}/$(MAN8SUBDIR) ; \ + install -m 644 $${lang}/man8/*.8 $(DESTDIR)$(MANDIR)/$${lang}/$(MAN8SUBDIR) ; \ + fi ; \ + done clean: -rm -f *~ \#* + -rm -f man5/*~ man5/\#* -rm -f man8/*~ man8/\#* diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/man5/setrans.conf.5 new/mcstrans-3.0/man/man5/setrans.conf.5 --- old/mcstrans-2.8/man/man5/setrans.conf.5 1970-01-01 01:00:00.000000000 +0100 +++ new/mcstrans-3.0/man/man5/setrans.conf.5 2019-11-28 13:46:48.000000000 +0100 @@ -0,0 +1,106 @@ +.TH "setrans.conf" "5" "13 July 2010" "[email protected]" "setrans.conf documentation" +.SH "NAME" +setrans.conf \- translation configuration file for MCS/MLS SELinux systems + +.SH "DESCRIPTION" +The +.I /etc/selinux/{SELINUXTYPE}/setrans.conf +configuration file specifies the way that SELinux MCS/MLS labels are translated into human +readable form by the mcstransd daemon. The default policies support 16 sensitivity levels (s0 through s15) and 1024 categories (c0 through c1023). Multiple categories can be separated with commas (c0,c1,c3,c5) and a range of categories can be shortened using dot notation (c0.c3,c5). + +.SS "Keywords" + +.TP +Base\fR +once a base is declared, subsequent sensitivity label definitions will have all modifiers applied to them during translation. +Sensitivity labels defined before the base declaration are immediately cached and no modifiers will be applied these are used as direct translations. + +.TP +Default\fR +defines the category bit range that will be used for inverse bits. + +.TP +Domain\fR +creates a new domain with the supplied name. + +.TP +Include\fR +read and process the contents of the specified configuration file. + +.TP +Join\fR +defines a character used to separate members of a modifier group when more than one is specified (ex. USA/AUS). + +.TP +ModifierGroup\fR +a means of grouping category bit definitions by how they modify the sensitivity label. + +.TP +Prefix\fR +word(s) that may proceed member(s) of a modifier group (ex. REL USA). + +.TP +Suffix\fR +word(s) that may follow member(s) of a modifier group (ex. USA EYES ONLY). + +.TP +Whitespace\fR +defines the set of acceptable white space characters that may be used in label being translated. + +.SS "Sensitivity Level Definition Examples" + +.TP +s0=SystemLow\fR +defines a translation of s0 (the lowest sensitivity level) with no categories to SystemLow. + +.TP +s15:c0.c1023=SystemHigh\fR +defines a translation of s15:c0.c1023 to SystemHigh. c0.c1023 is shorthand for all categories. A colon separates the sensitivity level and categories. + +.TP +s0\-s15:c0.c1023=SystemLow\-SystemHigh\fR +defines a range translation of s0\-s15:c0.c1023 to SystemLow\-SystemHigh. The two range components are separated by a dash. + +.TP +s0:c0=PatientRecord\fR +defines a translation of sensitivity s0 with category c0 to PatientRecord. + +.TP +s0:c1=Accounting\fR +defines a translation of sensitivity s0 with category c1 to Accounting. + +.TP +s2:c1,c2,c3=Confidential3Categories +.TP +s2:c1.c3=Confidential3Categories\fR +both define a translation of sensitivity s2 with categories c1, c2 and c3 to Confidential3Categories. + +.TP +s5=TopSecret\fR +defines a translation of sensitivity s5 with no categories to TopSecret. + +.SS "Constraint Examples" + +.TP +c0!c1 +if category bits 0 and 1 are both set, the constraint will fail and the original context will be returned. + +.TP +c5.c9>c1 +if category bits 5 through 9 are set, bit 1 must also be set or the constraint will fail and the original context will be returned. + +.TP +s1!c5,c9 +if category bits 5 and 9 are set and the sensitivity level is s1, the constraint will fail and the original context will be returned. + +.SH "AUTHOR" + Written by Joe Nall <[email protected]>. + Updated by Ted X. Toth <[email protected]>. + +.SH "SEE ALSO" +selinux(8), mcs(8), mls(8), chcon(1) + +.SH "FILES" +/etc/selinux/{SELINUXTYPE}/setrans.conf +.br +/usr/share/mcstrans/examples diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/man8/mcstransd.8 new/mcstrans-3.0/man/man8/mcstransd.8 --- old/mcstrans-2.8/man/man8/mcstransd.8 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/man/man8/mcstransd.8 2019-11-28 13:46:48.000000000 +0100 @@ -29,4 +29,4 @@ /etc/selinux/{SELINUXTYPE}/setrans.conf .SH "SEE ALSO" -.BR mcs (8), +.BR setrans.conf (5), mcs (8) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/man8/setrans.conf.8 new/mcstrans-3.0/man/man8/setrans.conf.8 --- old/mcstrans-2.8/man/man8/setrans.conf.8 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/man/man8/setrans.conf.8 1970-01-01 01:00:00.000000000 +0100 @@ -1,106 +0,0 @@ -.TH "setrans.conf" "8" "13 July 2010" "[email protected]" "setrans.conf documentation" -.SH "NAME" -setrans.conf \- translation configuration file for MCS/MLS SELinux systems - -.SH "DESCRIPTION" -The -.I /etc/selinux/{SELINUXTYPE}/setrans.conf -configuration file specifies the way that SELinux MCS/MLS labels are translated into human -readable form by the mcstransd daemon. The default policies support 16 sensitivity levels (s0 through s15) and 1024 categories (c0 through c1023). Multiple categories can be separated with commas (c0,c1,c3,c5) and a range of categories can be shortened using dot notation (c0.c3,c5). - -.SS "Keywords" - -.TP -Base\fR -once a base is declared, subsequent sensitivity label definitions will have all modifiers applied to them during translation. -Sensitivity labels defined before the base declaration are immediately cached and no modifiers will be applied these are used as direct translations. - -.TP -Default\fR -defines the category bit range that will be used for inverse bits. - -.TP -Domain\fR -creates a new domain with the supplied name. - -.TP -Include\fR -read and process the contents of the specified configuration file. - -.TP -Join\fR -defines a character used to separate members of a modifier group when more than one is specified (ex. USA/AUS). - -.TP -ModifierGroup\fR -a means of grouping category bit definitions by how they modify the sensitivity label. - -.TP -Prefix\fR -word(s) that may proceed member(s) of a modifier group (ex. REL USA). - -.TP -Suffix\fR -word(s) that may follow member(s) of a modifier group (ex. USA EYES ONLY). - -.TP -Whitespace\fR -defines the set of acceptable white space characters that may be used in label being translated. - -.SS "Sensitivity Level Definition Examples" - -.TP -s0=SystemLow\fR -defines a translation of s0 (the lowest sensitivity level) with no categories to SystemLow. - -.TP -s15:c0.c1023=SystemHigh\fR -defines a translation of s15:c0.c1023 to SystemHigh. c0.c1023 is shorthand for all categories. A colon separates the sensitivity level and categories. - -.TP -s0\-s15:c0.c1023=SystemLow\-SystemHigh\fR -defines a range translation of of s0\-s15:c0.c1023 to SystemLow\-SystemHigh. The two range components are separated by a dash. - -.TP -s0:c0=PatientRecord\fR -defines a translation of sensitivity s0 with category c0 to PatientRecord. - -.TP -s0:c1=Accounting\fR -defines a translation of sensitivity s0 with category c1 to Accounting. - -.TP -s2:c1,c2,c3=Confidential3Categories -.TP -s2:c1.c3=Confidential3Categories\fR -both define a translation of sensitivity s2 with categories c1, c2 and c3 to Confidential3Categories. - -.TP -s5=TopSecret\fR -defines a translation of sensitivity s5 with no categories to TopSecret. - -.SS "Constraint Examples" - -.TP -c0!c1 -if category bits 0 and 1 are both set, the constraint will fail and the original context will be returned. - -.TP -c5.c9>c1 -if category bits 5 through 9 are set, bit 1 must also be set or the constraint will fail and the original context will be returned. - -.TP -s1!c5,c9 -if category bits 5 and 9 are set and the sensitivity level is s1, the constraint will fail and the original context will be returned. - -.SH "AUTHOR" - Written by Joe Nall <[email protected]>. - Updated by Ted X. Toth <[email protected]>. - -.SH "SEE ALSO" -selinux(8), mcs(8), mls(8), chcon(1) - -.SH "FILES" -/etc/selinux/{SELINUXTYPE}/setrans.conf -.br -/usr/share/mcstrans/examples diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/ru/man5/setrans.conf.5 new/mcstrans-3.0/man/ru/man5/setrans.conf.5 --- old/mcstrans-2.8/man/ru/man5/setrans.conf.5 1970-01-01 01:00:00.000000000 +0100 +++ new/mcstrans-3.0/man/ru/man5/setrans.conf.5 2019-11-28 13:46:48.000000000 +0100 @@ -0,0 +1,106 @@ +.TH "setrans.conf" "5" "13 июля 2010" "[email protected]" "Документация по setrans.conf" +.SH "ИМЯ" +setrans.conf \- файл конфигурации преобразования для систем MCS/MLS SELinux + +.SH "ОПИСАНИЕ" +Файл конфигурации +.I /etc/selinux/{SELINUXTYPE}/setrans.conf +определяет способ, которым метки SELinux MCS/MLS преобразовываются в удобную для прочтения человеком форму с помощью внутренней службы mcstransd. Политики по умолчанию поддерживают 16 уровней конфиденциальности (от s0 до s15) и 1024 категории (от c0 до c1023). Если категорий несколько, их можно разделить запятыми (c0,c1,c3,c5), а диапазон категорий - сократить с помощью указания через точку (c0.c3,c5). + +.SS "Ключевые слова" + +.TP +Base\fR +когда объявляется база, ко всем последующим определениям меток конфиденциальности будут при преобразовании применяться модификаторы. +Метки конфиденциальности, которые были определены до объявления базы, незамедлительно кэшируются, и к ним не применяются модификаторы; они используются в качестве прямого преобразования. + +.TP +Default\fR +определяет битовый диапазон категорий, который будет использоваться для обратных битов. + +.TP +Domain\fR +создаёт новый домен с указанным именем. + +.TP +Include\fR +прочитать и обработать содержимое указанного файла конфигурации. + +.TP +Join\fR +определяет символ, который используется для разделения участников группы модификаторов, когда указано более одного (например, USA/AUS). + +.TP +ModifierGroup\fR +средство группировки битовых определений категорий по тому, как они изменяют метку конфиденциальности. + +.TP +Prefix\fR +слова (слова), которое может предшествовать участнику (участникам) группы модификаторов (например, REL USA). + +.TP +Suffix\fR +слово (слова), которое может следовать за участником (участниками) группы модификаторов (например, USA EYES ONLY). + +.TP +Whitespace\fR +определяет набор допустимых пробельных символов, которые могут использоваться в преобразовываемой метке. + +.SS "Примеры определения уровня конфиденциальности" + +.TP +s0=SystemLow\fR +определяет преобразование s0 (минимального уровня конфиденциальности) без категорий в SystemLow. + +.TP +s15:c0.c1023=SystemHigh\fR +определяет преобразование s15:c0.c1023 в SystemHigh. c0.c1023 - сокращённое обозначение всех категорий. Уровень конфиденциальности и категории разделены двоеточием. + +.TP +s0\-s15:c0.c1023=SystemLow\-SystemHigh\fR +определяет преобразование диапазона s0\-s15:c0.c1023 в SystemLow\-SystemHigh. Два компонента диапазона разделены дефисом. + +.TP +s0:c0=PatientRecord\fR +определяет преобразование уровня конфиденциальности s0 с категорией c0 в PatientRecord. + +.TP +s0:c1=Accounting\fR +определяет преобразование уровня конфиденциальности s0 с категорией c1 в Accounting. + +.TP +s2:c1,c2,c3=Confidential3Categories +.TP +s2:c1.c3=Confidential3Categories\fR +и то, и другое определяет преобразование уровня конфиденциальности s2 с категориями c1, c2 и c3 в Confidential3Categories. + +.TP +s5=TopSecret\fR +определяет преобразование уровня конфиденциальности s5 без категорий в TopSecret. + +.SS "Примеры ограничения" + +.TP +c0!c1 +если одновременно заданы биты категорий 0 и 1, ограничение не сработает и будет возвращён исходный контекст. + +.TP +c5.c9>c1 +если заданы биты категорий с 5 по 9, бит 1 также необходимо установить - иначе ограничение не сработает и будет возвращён исходный контекст. + +.TP +s1!c5,c9 +если заданы биты категорий с 5 по 9 и уровень конфиденциальности равен s1, ограничение не сработает и будет возвращён исходный контекст. + +.SH "ФАЙЛЫ" +/etc/selinux/{SELINUXTYPE}/setrans.conf +.br +/usr/share/mcstrans/examples + +.SH "СМОТРИТЕ ТАКЖЕ" +selinux(8), mcs(8), mls(8), chcon(1) + +.SH "АВТОРЫ" + Написано Joe Nall <[email protected]>. + Обновлено Ted X. Toth <[email protected]>. + Перевод на русский язык выполнила Герасименко Олеся <[email protected]>. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/ru/man8/mcs.8 new/mcstrans-3.0/man/ru/man8/mcs.8 --- old/mcstrans-2.8/man/ru/man8/mcs.8 1970-01-01 01:00:00.000000000 +0100 +++ new/mcstrans-3.0/man/ru/man8/mcs.8 2019-11-28 13:46:48.000000000 +0100 @@ -0,0 +1,24 @@ +.TH "mcs" "8" "8 сентября 2005" "[email protected]" "Документация по MCS" + +.SH "ИМЯ" +mcs \- мультикатегорийная система + +.SH "ОПИСАНИЕ" +MCS (мультикатегорийная система) позволяет пользователям проставлять в своей системе метки для файлов внутри определённых администратором категорий. Затем эта система использует принудительное управление доступом SELinux, чтобы защитить эти файлы. MCS - дискреционная модель, которая позволяет пользователям отмечать свои данные дополнительными тегами, накладывая дальнейшие ограничения доступа. Обязательным является только один аспект - авторизовывать пользователей для категорий, определяя их уровень допуска в политике. MCS похожа на MLS, выполняет те же самые пути кода и использует ту же самую инфраструктуру поддержки. Они отличаются между собой только спецификой настройки. + + +Файл конфигурации +.I /etc/selinux/{SELINUXTYPE}/setrans.conf +преобразовывает метки на диске в удобную для прочтения человеком форму. В этом файле администраторы могут определить любые необходимые метки. +Некоторые приложения, такие как вывод на экран и аудит, будут использовать эти метки для идентификации файлов. Если для файла будет задана категория, другие приложения/службы не получат к нему доступ. +.P +Примеры меток файлов: PatientRecord, CompanyConfidential и так далее. + +.SH "СМОТРИТЕ ТАКЖЕ" +selinux(8), chcon(1) + +.SH ФАЙЛЫ +/etc/selinux/{SELINUXTYPE}/setrans.conf + +.SH АВТОРЫ +Перевод на русский язык выполнила Герасименко Олеся <[email protected]> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/man/ru/man8/mcstransd.8 new/mcstrans-3.0/man/ru/man8/mcstransd.8 --- old/mcstrans-2.8/man/ru/man8/mcstransd.8 1970-01-01 01:00:00.000000000 +0100 +++ new/mcstrans-3.0/man/ru/man8/mcstransd.8 2019-11-28 13:46:48.000000000 +0100 @@ -0,0 +1,32 @@ +.TH "mcstransd" "8" "16 октября 2009" "[email protected]" "Документация по MCS" +.SH "ИМЯ" +mcstransd \- внутренняя служба MCS (мультикатегорийная система). Переводит метки MCS/MLS SELinux в удобную для прочтения человеком форму. + +.SH "ОБЗОР" +.B mcstransd [-f] [-h] +.P + +.SH "ОПИСАНИЕ" +Эта страница руководства содержит описание программы +.BR mcstransd. +.P +Эта внутренняя служба выполняет чтение файла конфигурации /etc/selinux/{SELINUXTYPE}/setrans.conf и связывается с libselinux через сокет в /var/run/setrans. +.SH "ПАРАМЕТРЫ" +.TP +\-f +Запустить mcstransd на переднем плане. Не запускать как внутреннюю службу. +.TP +\-h +Вывести краткое описание доступных параметров командной строки\&. + +.SH "ФАЙЛЫ" +/etc/selinux/{SELINUXTYPE}/setrans.conf + +.SH "СМОТРИТЕ ТАКЖЕ" +.BR setrans.conf (5), mcs (8) + +.SH "АВТОРЫ" +Эта man-страница написана Dan Walsh <[email protected]>. +Исходная версия программы написана Dan Walsh <[email protected]>. +Программа улучшена/переписана Joe Nall <[email protected]>. +Перевод на русский язык выполнила Герасименко Олеся <[email protected]>. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/default/setrans.conf new/mcstrans-3.0/share/examples/default/setrans.conf --- old/mcstrans-2.8/share/examples/default/setrans.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/default/setrans.conf 2019-11-28 13:46:48.000000000 +0100 @@ -1,7 +1,7 @@ # # Multi-Level Security translation table for SELinux -# -# Uncomment the following to disable translation libary +# +# Uncomment the following to disable translation library # disable=1 # # Objects can be labeled with one of 16 levels and be categorized with 0-1023 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/include/setrans.conf new/mcstrans-3.0/share/examples/include/setrans.conf --- old/mcstrans-2.8/share/examples/include/setrans.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/include/setrans.conf 2019-11-28 13:46:48.000000000 +0100 @@ -1,7 +1,7 @@ # # Multi-Level Security translation table for SELinux -# -# Uncomment the following to disable translation libary +# +# Uncomment the following to disable translation library # disable=1 # # Objects can be labeled with one of 16 levels and be categorized with 0-1023 @@ -10,6 +10,6 @@ # Users can modify this table to translate the MLS labels for different purpose. # -# Demonstrate Include by moving everthing to an include file +# Demonstrate Include by moving everything to an include file # Include=/etc/selinux/mls/setrans.d/include-example diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/include/setrans.d/include-example new/mcstrans-3.0/share/examples/include/setrans.d/include-example --- old/mcstrans-2.8/share/examples/include/setrans.d/include-example 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/include/setrans.d/include-example 2019-11-28 13:46:48.000000000 +0100 @@ -1,7 +1,7 @@ # # Multi-Level Security translation table for SELinux -# -# Uncomment the following to disable translation libary +# +# Uncomment the following to disable translation library # disable=1 # # Objects can be labeled with one of 16 levels and be categorized with 0-1023 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/nato/setrans.d/rel.conf new/mcstrans-3.0/share/examples/nato/setrans.d/rel.conf --- old/mcstrans-2.8/share/examples/nato/setrans.d/rel.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/nato/setrans.d/rel.conf 2019-11-28 13:46:48.000000000 +0100 @@ -9,7 +9,7 @@ Prefix=RELEASEABLE TO Default=c200.c511 -~c200.c511=EVERBODY +~c200.c511=EVERYBODY ~c200,~c205,~c219,~c223,~c239,~c257,~c258,~c261,~c268,~c269,~c274,~c278,~c288,~c298,~c300,~c308,~c310,~c331,~c332,~c333,~c365,~c366,~c378,~c381,~c387,~c406,~c407,~c423,~c430=NATO @@ -748,4 +748,4 @@ ~c200,~c444=ZI # Zimbabwe ~c200,~c444=ZWE # Zimbabwe -#UNCLASSIFIED \ No newline at end of file +#UNCLASSIFIED diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/urcsts/secolor.conf new/mcstrans-3.0/share/examples/urcsts/secolor.conf --- old/mcstrans-2.8/share/examples/urcsts/secolor.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/urcsts/secolor.conf 2019-11-28 13:46:48.000000000 +0100 @@ -17,5 +17,5 @@ range s5-s5:c0.c1023 = white blue range s7-s7:c0.c1023 = black red range s9-s9:c0.c1023 = black orange -range s15:c0.c1023 = black yellow +range s15-s15:c0.c1023 = black yellow diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/urcsts-via-include/secolor.conf new/mcstrans-3.0/share/examples/urcsts-via-include/secolor.conf --- old/mcstrans-2.8/share/examples/urcsts-via-include/secolor.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/urcsts-via-include/secolor.conf 2019-11-28 13:46:48.000000000 +0100 @@ -17,5 +17,5 @@ range s5-s5:c0.c1023 = white blue range s7-s7:c0.c1023 = black red range s9-s9:c0.c1023 = black orange -range s15:c0.c1023 = black yellow +range s15-s15:c0.c1023 = black yellow diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/examples/urcsts-via-include/setrans.conf new/mcstrans-3.0/share/examples/urcsts-via-include/setrans.conf --- old/mcstrans-2.8/share/examples/urcsts-via-include/setrans.conf 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/examples/urcsts-via-include/setrans.conf 2019-11-28 13:46:48.000000000 +0100 @@ -1,7 +1,7 @@ # # Multi-Level Security translation table for SELinux -# -# Uncomment the following to disable translation libary +# +# Uncomment the following to disable translation library # disable=1 # # Objects can be labeled with one of 16 levels and be categorized with 0-1023 @@ -10,6 +10,6 @@ # Users can modify this table to translate the MLS labels for different purpose. # -# Demonstrate Include by moving everthing to an include file +# Demonstrate Include by moving everything to an include file # Include=/etc/selinux/mls/setrans.d/*.conf diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/util/mlscolor-test new/mcstrans-3.0/share/util/mlscolor-test --- old/mcstrans-2.8/share/util/mlscolor-test 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/util/mlscolor-test 2019-11-28 13:46:48.000000000 +0100 @@ -1,7 +1,8 @@ -#!/usr/bin/python -E +#!/usr/bin/python3 -E import sys -import re -from selinux import * +import selinux + + verbose = 0 errors = 0 @@ -18,19 +19,19 @@ line = line.rstrip('\n') # print line context, expected = line.split("=") - rc, raw = selinux_trans_to_raw_context(context) + rc, raw = selinux.selinux_trans_to_raw_context(context) if rc < 0: - print "Unable to get raw context of '%s'" % (context) + print("Unable to get raw context of '%s'" % (context)) errors += 1 continue - rc, colors = selinux_raw_context_to_color(raw) + rc, colors = selinux.selinux_raw_context_to_color(raw) if rc < 0: - print "Unable to get colors for '%s'" % (context) + print("Unable to get colors for '%s'" % (context)) errors += 1 continue colors = colors.rstrip() if colors != expected: - print "For '%s' got\n\t'%s' expected\n\t'%s'" % (context, colors, expected) + print("For '%s' got\n\t'%s' expected\n\t'%s'" % (context, colors, expected)) errors += 1 continue f.close() @@ -38,6 +39,6 @@ s = "s" if errors == 1: s = "" -print "mlscolor-test done with %d error%s" % (errors, s) +print("mlscolor-test done with %d error%s" % (errors, s)) sys.exit(errors) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/share/util/mlstrans-test new/mcstrans-3.0/share/util/mlstrans-test --- old/mcstrans-2.8/share/util/mlstrans-test 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/share/util/mlstrans-test 2019-11-28 13:46:48.000000000 +0100 @@ -1,31 +1,33 @@ -#!/usr/bin/python -E +#!/usr/bin/python3 -E import sys -import re -from selinux import * +import selinux + + verbose = 0 errors = 0 def untrans(trans, val): global errors, verbose - (rc, raw) = selinux_trans_to_raw_context(trans) + (rc, raw) = selinux.selinux_trans_to_raw_context(trans) if raw != val: - print "untrans: '%s' -> '%s' != '%s' FAILED" % (trans, raw, val) + print("untrans: '%s' -> '%s' != '%s' FAILED" % (trans, raw, val)) errors += 1 else: if verbose: - print "untrans: %s -> %s != %s SUCCESS" % (trans, raw, val) + print("untrans: %s -> %s != %s SUCCESS" % (trans, raw, val)) def trans(raw, val): global errors, verbose - (rc, trans) = selinux_raw_to_trans_context(raw) + (rc, trans) = selinux.selinux_raw_to_trans_context(raw) if trans != val: - print "trans: '%s' -> '%s' != '%s' FAILED" % (raw, trans, val) + print("trans: '%s' -> '%s' != '%s' FAILED" % (raw, trans, val)) errors += 1 else: if verbose: - print "trans: %s -> %s != %s SUCCESS" % (raw, trans, val) + print("trans: %s -> %s != %s SUCCESS" % (raw, trans, val)) + if len(sys.argv) > 1 and sys.argv[1] == "-v": verbose = 1 @@ -38,8 +40,7 @@ if not line.strip(): continue line = line.rstrip('\n') -# print line - if (line.find("==") != -1): + if line.find("==") != -1: t, r = line.split("==") untrans("a:b:c:" + t, "a:b:c:" + r) trans("a:b:c:" + r, "a:b:c:" + t) @@ -51,6 +52,6 @@ s = "s" if errors == 1: s = "" -print "mlstrans-test done with %d error%s" % (errors, s) +print("mlstrans-test done with %d error%s" % (errors, s)) sys.exit(errors) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/src/mcscolor.c new/mcstrans-3.0/src/mcscolor.c --- old/mcstrans-2.8/src/mcscolor.c 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/src/mcscolor.c 2019-11-28 13:46:48.000000000 +0100 @@ -134,12 +134,12 @@ } while (ptr) { - if (fnmatch(ptr->pattern, component, 0) == 0) { - if (idx == COLOR_RANGE) { - if (check_dominance(ptr->pattern, raw) == 0) - return &ptr->color; - } else - return &ptr->color; + if (idx == COLOR_RANGE) { + if (check_dominance(ptr->pattern, raw) == 0) + return &ptr->color; + } else { + if (fnmatch(ptr->pattern, component, 0) == 0) + return &ptr->color; } ptr = ptr->next; } @@ -211,7 +211,7 @@ /* Process line from color file. - May modify the data pointed to by the buffer paremeter */ + May modify the data pointed to by the buffer parameter */ static int process_color(char *buffer, int line) { char rule[10], pat[256], f[256], b[256]; uint32_t i, fg, bg; @@ -292,7 +292,7 @@ size_t result_size = (N_COLOR * CHARS_PER_COLOR) + 1; int rc = -1; - if (!color_str || !*color_str) { + if (!color_str || *color_str) { return -1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/src/mcstrans.c new/mcstrans-3.0/src/mcstrans.c --- old/mcstrans-2.8/src/mcstrans.c 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/src/mcstrans.c 2019-11-28 13:46:48.000000000 +0100 @@ -708,6 +708,7 @@ err: log_error("allocation error %s", strerror(errno)); + free(affix); return -1; } @@ -1517,8 +1518,10 @@ } else { trans = compute_trans_from_raw(range, domain); if (trans) - if (add_cache(domain, range, trans) < 0) + if (add_cache(domain, range, trans) < 0) { + free(range); return -1; + } } if (lrange && urange) { @@ -1526,12 +1529,15 @@ if (! ltrans) { ltrans = compute_trans_from_raw(lrange, domain); if (ltrans) { - if (add_cache(domain, lrange, ltrans) < 0) + if (add_cache(domain, lrange, ltrans) < 0) { + free(range); return -1; + } } else { ltrans = strdup(lrange); if (! ltrans) { log_error("strdup failed %s", strerror(errno)); + free(range); return -1; } } @@ -1541,25 +1547,36 @@ if (! utrans) { utrans = compute_trans_from_raw(urange, domain); if (utrans) { - if (add_cache(domain, urange, utrans) < 0) + if (add_cache(domain, urange, utrans) < 0) { + free(ltrans); + free(range); return -1; + } } else { utrans = strdup(urange); if (! utrans) { log_error("strdup failed %s", strerror(errno)); - return -1; - } - } + free(ltrans); + free(range); + return -1; + } + } } if (strcmp(ltrans, utrans) == 0) { if (asprintf(&trans, "%s", ltrans) < 0) { log_error("asprintf failed %s", strerror(errno)); + free(utrans); + free(ltrans); + free(range); return -1; } } else { if (asprintf(&trans, "%s-%s", ltrans, utrans) < 0) { log_error("asprintf failed %s", strerror(errno)); + free(utrans); + free(ltrans); + free(range); return -1; } } @@ -1629,13 +1646,17 @@ if (!canonical) { canonical = compute_trans_from_raw(raw, domain); if (canonical && strcmp(canonical, range)) - if (add_cache(domain, raw, canonical) < 0) + if (add_cache(domain, raw, canonical) < 0) { + free(range); return -1; + } } if (canonical) free(canonical); - if (add_cache(domain, raw, range) < 0) + if (add_cache(domain, raw, range) < 0) { + free(range); return -1; + } } else { log_debug("untrans_context unable to compute raw context %s\n", range); } @@ -1650,17 +1671,24 @@ if (!canonical) { canonical = compute_trans_from_raw(lraw, domain); if (canonical) - if (add_cache(domain, lraw, canonical) < 0) + if (add_cache(domain, lraw, canonical) < 0) { + free(lraw); + free(range); return -1; + } } if (canonical) free(canonical); - if (add_cache(domain, lraw, lrange) < 0) + if (add_cache(domain, lraw, lrange) < 0) { + free(lraw); + free(range); return -1; + } } else { lraw = strdup(lrange); if (! lraw) { log_error("strdup failed %s", strerror(errno)); + free(range); return -1; } } @@ -1674,17 +1702,27 @@ if (!canonical) { canonical = compute_trans_from_raw(uraw, domain); if (canonical) - if (add_cache(domain, uraw, canonical) < 0) + if (add_cache(domain, uraw, canonical) < 0) { + free(uraw); + free(lraw); + free(range); return -1; } + } if (canonical) free(canonical); - if (add_cache(domain, uraw, urange) < 0) + if (add_cache(domain, uraw, urange) < 0) { + free(uraw); + free(lraw); + free(range); return -1; + } } else { uraw = strdup(urange); if (! uraw) { log_error("strdup failed %s", strerror(errno)); + free(lraw); + free(range); return -1; } } @@ -1694,11 +1732,17 @@ if (strcmp(lraw, uraw) == 0) { if (asprintf(&raw, "%s", lraw) < 0) { log_error("asprintf failed %s", strerror(errno)); + free(uraw); + free(lraw); + free(range); return -1; } } else { if (asprintf(&raw, "%s-%s", lraw, uraw) < 0) { log_error("asprintf failed %s", strerror(errno)); + free(uraw); + free(lraw); + free(range); return -1; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/src/mcstrans.service new/mcstrans-3.0/src/mcstrans.service --- old/mcstrans-2.8/src/mcstrans.service 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/src/mcstrans.service 2019-11-28 13:46:48.000000000 +0100 @@ -1,5 +1,6 @@ [Unit] Description=Translates SELinux MCS/MLS labels to human readable form +Documentation=man:mcstransd(8) ConditionSecurity=selinux [Service] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mcstrans-2.8/src/mcstransd.c new/mcstrans-3.0/src/mcstransd.c --- old/mcstrans-2.8/src/mcstransd.c 2018-05-24 20:21:09.000000000 +0200 +++ new/mcstrans-3.0/src/mcstransd.c 2019-11-28 13:46:48.000000000 +0100 @@ -142,17 +142,8 @@ { int32_t result; char *out = NULL; - char *peercon = NULL; int ret; - ret = getpeercon_raw(fd, &peercon); - if (ret < 0) - return ret; - - /* TODO: Check if MLS clearance (in peercon) dominates the MLS label - * (in the request input). - */ - switch (function) { case SETRANS_INIT: result = 0; @@ -184,7 +175,6 @@ } free(out); - freecon(peercon); return ret; } ++++++ mcstrans-writepid.patch ++++++ --- /var/tmp/diff_new_pack.Xr6E39/_old 2020-03-21 16:46:35.761612769 +0100 +++ /var/tmp/diff_new_pack.Xr6E39/_new 2020-03-21 16:46:35.773612782 +0100 @@ -1,7 +1,7 @@ -Index: mcstrans-2.7/src/mcstransd.c +Index: mcstrans-2.9/src/mcstransd.c =================================================================== ---- mcstrans-2.7.orig/src/mcstransd.c -+++ mcstrans-2.7/src/mcstransd.c +--- mcstrans-2.9.orig/src/mcstransd.c 2019-03-21 08:39:36.020981841 +0100 ++++ mcstrans-2.9/src/mcstransd.c 2019-03-21 08:43:15.456387335 +0100 @@ -14,6 +14,7 @@ #include <sys/socket.h> #include <sys/stat.h> @@ -10,7 +10,12 @@ #include <sys/uio.h> #include <sys/un.h> #include "mcstrans.h" -@@ -62,7 +63,7 @@ static int sockfd = -1; /* socket we are +@@ -59,10 +60,12 @@ extern int raw_color(const security_cont + + static int sockfd = -1; /* socket we are listening on */ + ++static const char *pidfile = "/var/run/mcstransd.pid"; ++ static volatile int restart_daemon = 0; static void cleanup_exit(int ret) __attribute__ ((noreturn)); static void @@ -19,16 +24,7 @@ { finish_context_colors(); finish_context_translations(); -@@ -152,7 +153,7 @@ process_request(int fd, uint32_t functio - /* TODO: Check if MLS clearance (in peercon) dominates the MLS label - * (in the request input). - */ -- -+ - switch (function) { - case SETRANS_INIT: - result = 0; -@@ -231,7 +232,7 @@ service_request(int fd) +@@ -221,7 +224,7 @@ service_request(int fd) data1 = malloc(data1_size); if (!data1) { log_debug("Could not allocate %d bytes\n", data1_size); @@ -37,12 +33,10 @@ } data2 = malloc(data2_size); if (!data2) { -@@ -542,6 +543,30 @@ static void usage(char *program) +@@ -532,6 +535,28 @@ static void usage(char *program) printf("%s [-f] [-h] \n", program); } -+static const char *pidfile = "/var/run/mcstransd.pid"; -+ +static int write_pid_file(void) +{ + int pidfd, len; @@ -68,7 +62,7 @@ int main(int argc, char *argv[]) { -@@ -585,6 +610,8 @@ main(int argc, char *argv[]) +@@ -575,6 +600,8 @@ main(int argc, char *argv[]) } #endif
