Merge20251008 #497
Closed
Merge20251008 #497
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This patch adds missing examples to the semanage-port and
semanage-fcontext man pages showing the correct usage of the -r RANGE
flag for MLS/MCS systems. Currently, users who try to use the -r flag
without proper examples often encounter unclear error messages when
they provide invalid range formats.
For example, here is a command with wrong range string value:
libsepol.mls_from_string: invalid MLS context s0.c0 (No such file or directory)
[...error output...]
The added examples demonstrate:
- Correct MLS range format: s0:c0.c255
- Complete command syntax with the -r flag for both port and
fcontext operations
- Clear indication that this is for MLS/MCS systems only
- Verification method using seinfo for port changes (semanage port -l
only shows type, not MLS range)
- Use -F flag to restorecon in fcontext example (required to force
relabeling)
Signed-off-by: Pranav Lawate <[email protected]>
Acked-by: Stephen Smalley <[email protected]>
For some reason, rm is invoked via system (3) to cleanup the runtime temp directory. This really isn't all that robust, *especially* given that seunshare is supposed to be a security boundary. Instead do this using libc, the API designed to be used within C programs. Also make sure that we don't follow symbolic links; the input being deleted is untrusted, and hence a malicious symbolic link may be placed outside of the sandbox. Signed-off-by: Rahul Sandhu <[email protected]> Acked-by: Stephen Smalley <[email protected]>
|
PR for CI testing only |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please read CONTRIBUTING.md
Contributing Code
Post the patch for the review to the
SELinux mailing list at
[email protected].
When preparing patches, please follow these guidelines:
code meets the Developer's certificate of origin, see below.