{"push_id":1425748033,"size":158,"distinct_size":158,"ref":"refs/heads/master","head":"2907caa33cbb722ecf423aa47e43f4f5053c2723","before":"0cea223d333a7d35b91263d591f1aba3c00676b4","commits":[{"sha":"1cd80faa53b67aa508c57176f1aafe6cf2e69575","author":{"name":"Jason Zaman","email":"158e602a35675d2a0b685478824aa5995557a235@perfinion.com"},"message":"libselinux: versioned ruby pkg-config and query vendorarchdir properly\n\nGentoo and Arch have pkg-config entries for \"ruby-$(RUBYLIBVER)\" but not\nfor \"ruby\". Check if that exists first then fall back to plain ruby if\nit does not.\n\nThe ruby install paths were incorrect. Fedora 20 installed to\n/usr/lib64/ruby/vendor_ruby/, Arch needs it to be vendor_ruby as well,\nsite_ruby does not work. Thanks to Nicolas Iooss for the correct way to\nquery for the path.\n\nSigned-off-by: Jason Zaman <jason@perfinion.com>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/1cd80faa53b67aa508c57176f1aafe6cf2e69575"},{"sha":"8162f10e670da963eb65ccf1e7de69ea85aba30d","author":{"name":"Jason Zaman","email":"158e602a35675d2a0b685478824aa5995557a235@perfinion.com"},"message":"libselinux: query for python site-packages dir directly\n\ninstead of building the path manually which is more error prone\n\nSigned-off-by: Jason Zaman <jason@perfinion.com>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/8162f10e670da963eb65ccf1e7de69ea85aba30d"},{"sha":"df52ef00f3da6321dd6acb9bf8800d5743be41b3","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"Updated libselinux ChangeLog\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/df52ef00f3da6321dd6acb9bf8800d5743be41b3"},{"sha":"9d25ca61603a2eed08d1b58b25c81f878c729474","author":{"name":"James Carter","email":"81a23ad70c957ea107796f41c953bf4630f25afa@tycho.nsa.gov"},"message":"libsemanage: Fixes bug preventing the installation of base modules\n\nCommit 7a728e46 changed module installation so that a module pp would\nbe installed using its module name instead of its filename and a warning\nwould be printed if they were different. With this change, base modules\ncould no longer be installed because of the way error handling was done.\n\nThis change fixes the error handling, so that when a base module is\ninstalled it will be installed using its filename (since it does not\nhave a module name).\n\nBased on bug report by Jason Zaman\n\nSigned-off-by: James Carter <jwcart2@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/9d25ca61603a2eed08d1b58b25c81f878c729474"},{"sha":"790684d256806a1af84079885c059b4b042e2fab","author":{"name":"James Carter","email":"81a23ad70c957ea107796f41c953bf4630f25afa@tycho.nsa.gov"},"message":"Updated libsemanage ChangeLog.\n\nSigned-off-by: James Carter <jwcart2@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/790684d256806a1af84079885c059b4b042e2fab"},{"sha":"48965c602cadbd1affaf70d2759c0b09a603051b","author":{"name":"Gary Tierney","email":"437c2c22888f2f80b5bbcc2ba683986a88ecf3e3@gmx.com"},"message":"libsepol/cil: create user and role caches when building binary policy\n\nPre-expands the role and user caches used in context validation when\nconerting a cildb to a binary policydb.  This is currently only done\nwhen loading a binary policy and prevents context validation from\nworking correctly with a newly built policy (i.e., when semanage builds\na new policy and then runs genhomedircon).\n\nAlso adds declarations for the hashtable mapping functions used:\npolicydb_role_cache and policydb_user_cache().\n\nSigned-off-by: Gary Tierney <gary.tierney@gmx.com>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/48965c602cadbd1affaf70d2759c0b09a603051b"},{"sha":"b461051bc48a78f3ba4939dd808630ef86f8bb57","author":{"name":"James Carter","email":"81a23ad70c957ea107796f41c953bf4630f25afa@tycho.nsa.gov"},"message":"Updated libsepol ChangeLog.\n\nSigned-off-by: James Carter <jwcart2@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/b461051bc48a78f3ba4939dd808630ef86f8bb57"},{"sha":"5694d2683916d4b3c3f5d65fc1c0aa6a45d43fa9","author":{"name":"James Carter","email":"81a23ad70c957ea107796f41c953bf4630f25afa@tycho.nsa.gov"},"message":"libsepol: Add support for converting extended permissions to CIL\n\nCheckpolicy has an option to produce CIL output and is dependent on\nthe policydb-to-CIL conversion in libsepol for that option. Add\nsupport for converting extended permissions to CIL so that checlpolicy\ncan generate CIL.\n\nSigned-off-by: James Carter <jwcart2@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/5694d2683916d4b3c3f5d65fc1c0aa6a45d43fa9"},{"sha":"f1ba58a199fff4e146206e83048a083c7a61677c","author":{"name":"Nicolas Iooss","email":"d3457e454cf019ca2de7f483c3d6bc52529b443c@m4x.org"},"message":"libsepol/cil: make cil_resolve_name() fail for '.'\n\nThis CIL policy makes secilc crash with a NULL pointer dereference:\n\n    (class CLASS (PERM))\n    (classorder (CLASS))\n    (sid SID)\n    (sidorder (SID))\n    (user USER)\n    (role ROLE)\n    (type TYPE)\n    (category CAT)\n    (categoryorder (CAT))\n    (sensitivity SENS)\n    (sensitivityorder (SENS))\n    (sensitivitycategory SENS (CAT))\n    (allow TYPE self (CLASS (PERM)))\n    (roletype ROLE TYPE)\n    (userrole USER ROLE)\n    (userlevel USER (SENS))\n    (userrange USER ((SENS)(SENS (CAT))))\n    (sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))\n\n    (allow . self (CLASS (PERM)))\n\nUsing \".\" in the allow statement makes strtok_r() return NULL in\ncil_resolve_name() and this result is then used in a call to\ncil_symtab_get_datum(), which is thus invalid.\n\nInstead of crashing, make secilc fail with an error message.\n\nThis bug has been found by fuzzing secilc with american fuzzy lop.\n\nSigned-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/f1ba58a199fff4e146206e83048a083c7a61677c"},{"sha":"81c9ca5f961f9da18fd71bb041e8b90469f26d82","author":{"name":"Nicolas Iooss","email":"d3457e454cf019ca2de7f483c3d6bc52529b443c@m4x.org"},"message":"libsepol/cil: fix double-free in cil categories parser\n\nWhen cil_fill_cats() fails to parse an expression and destroys a\ncategory set, it fails to reset *cats to NULL. This makes this object be\ndestroyed again in cil_destroy_catset().\n\nThis bug can be triggered by the following policy:\n\n    (class CLASS (PERM))\n    (classorder (CLASS))\n    (sid SID)\n    (sidorder (SID))\n    (user USER)\n    (role ROLE)\n    (type TYPE)\n    (category CAT)\n    (categoryorder (CAT))\n    (sensitivity SENS)\n    (sensitivityorder (SENS))\n    (sensitivitycategory SENS (CAT))\n    (allow TYPE self (CLASS (PERM)))\n    (roletype ROLE TYPE)\n    (userrole USER ROLE)\n    (userlevel USER (SENS))\n    (userrange USER ((SENS)(SENS (CAT))))\n    (sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))\n\n    (categoryset cats (range unknown))\n\nThis bug has been found by fuzzing secilc with american fuzzy lop.\n\nSigned-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/81c9ca5f961f9da18fd71bb041e8b90469f26d82"},{"sha":"ac12826c110eae35d56ad38a93ada70aee31b4bd","author":{"name":"Nicolas Iooss","email":"d3457e454cf019ca2de7f483c3d6bc52529b443c@m4x.org"},"message":"libsepol/cil: fix memory leak in __cil_fill_expr()\n\n__cil_fill_expr() initializes 'cil_list *sub_expr' but does not destroy\nit when __cil_fill_expr_helper() fails. This list is therefore leaked\nwhen __cil_fill_expr() returns.\n\nThis occurs when secilc compiles the following policy:\n\n    (class CLASS (PERM))\n    (classorder (CLASS))\n    (sid SID)\n    (sidorder (SID))\n    (user USER)\n    (role ROLE)\n    (type TYPE)\n    (category CAT)\n    (categoryorder (CAT))\n    (sensitivity SENS)\n    (sensitivityorder (SENS))\n    (sensitivitycategory SENS (CAT))\n    (allow TYPE self (CLASS (PERM)))\n    (roletype ROLE TYPE)\n    (userrole USER ROLE)\n    (userlevel USER (SENS))\n    (userrange USER ((SENS)(SENS (CAT))))\n    (sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))\n\n    (categoryset cats (not (range unknown)))\n\nThis bug has been found using gcc address sanitizer.\n\nSigned-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/ac12826c110eae35d56ad38a93ada70aee31b4bd"},{"sha":"90dd84b133be5f3f218bde224487c29c6d24e75d","author":{"name":"James Carter","email":"81a23ad70c957ea107796f41c953bf4630f25afa@tycho.nsa.gov"},"message":"Updated libsepol ChangeLog.\n\nSigned-off-by: James Carter <jwcart2@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/90dd84b133be5f3f218bde224487c29c6d24e75d"},{"sha":"aa0c824bb2eeb8960ba02133faade72c837ea951","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"libselinux: selinux_restorecon: fix realpath logic\n\nThe realpath logic in selinux_restorecon() was taken from the\nAndroid libselinux fork.  However, bionic dirname() and basename()\ndo not modify their argument and therefore are safe to call on a\nconst string.  POSIX dirname() and basename() can modify their argument.\nThere is a GNU basename() that does not modify its argument, but not\nfor dirname().\nFor portability, create copies of the original pathname for each call\nand keep them around until finished using the result.\n\nFixes \"restorecon -r goes up the tree?\" bug reported by Jason Zaman.\n\nReported-by: Jason Zaman <jason@perfinion.com>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/aa0c824bb2eeb8960ba02133faade72c837ea951"},{"sha":"794c9afe99896c1c4852331f994ea46ee6f5e2da","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"Updated libselinux ChangeLog\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/794c9afe99896c1c4852331f994ea46ee6f5e2da"},{"sha":"b514885063d7e052c1cd1b4e4e6a8f668ac45e7b","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"libsepol, libsemanage: fix linker scripts / map files\n\nThe local: * entry should only be in the base entry, not in each of them.\nThis is part of resolving gold linker build failures reported by\nJason Zaman.\n\nReported-by: Jason Zaman <jason@perfinion.com>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/b514885063d7e052c1cd1b4e4e6a8f668ac45e7b"},{"sha":"82f994550f955ceb8cb86f1b9fc8602695b6e694","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"Updated ChangeLogs\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/82f994550f955ceb8cb86f1b9fc8602695b6e694"},{"sha":"88e334f1923396d5ace56b8439c731dcde0d1f3b","author":{"name":"Gary Tierney","email":"437c2c22888f2f80b5bbcc2ba683986a88ecf3e3@gmx.com"},"message":"genhomedircon: use userprefix as the role for homedir content\n\nTreat a users prefix like a mapping to the role for file context\nspecifications in users homedirs.  This behavior is only applicable when\nthe users prefix is the identifier of a role which is valid for the\ngiven user.  If the prefix is not a valid role, then genhomedircon will\nwrite contexts out as normal.\n\nAdditionally, this commit enables configuring RBACSEP in policy:\n\n(tunableif enable_rbacsep\n    (true\n        (userprefix user_u user_r)\n    (false\n        (userprefix user_u object_r))))\n\nSigned-off-by: Gary Tierney <gary.tierney@gmx.com>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/88e334f1923396d5ace56b8439c731dcde0d1f3b"},{"sha":"4a6545c7df3cf9f48861d32628ab7ffc62c2dfee","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"Updated libsemanage ChangeLog\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/4a6545c7df3cf9f48861d32628ab7ffc62c2dfee"},{"sha":"f9d1b1d16f32645607d67f605b23d75f5b6ecab4","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"libsemanage: genhomedircon: do not suppress logging from libsepol\n\nAs reported by Gary Tierney, genhomedircon suppresses logging from\nlibsepol when validating contexts.  This can result in an\nempty file_contexts.homedirs file without any warning to the user\nif policy has been incorrectly configured.  Remove the code that\nwas suppressing the logging so that errors are reported to the user.\n\nReported-by: Gary Tierney <gary.tierney@gmx.com>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/f9d1b1d16f32645607d67f605b23d75f5b6ecab4"},{"sha":"d3467b67a032e3cbb3675f159220e421635e165b","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"Updated libsemanage ChangeLog\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/perfinion/selinux/commits/d3467b67a032e3cbb3675f159220e421635e165b"}]}
{"actor":{"display_login":"perfinion"}}