selinux_init_load_policy: setenforce(0) if security_disable() fails

If you run selinux_init_load_policy() after a chroot/switch-root, it's
possible that your *previous* root loaded policy, but your *new* root
wants SELinux disabled.

We can't disable SELinux in this case, but we *do* need to make sure
it's permissive. Otherwise we may continue to enforce the old policy.

So, if seconfig = -1, but security_disable() fails, we set *enforce=0,
and then let the existing code handle the security_{get,set}enforce
stuff.

Once that's handled, exit with failure via "goto noload", as before.
Update XDG_RUNTIME_DIR directory
Remove handling of cgroups from sandbox

It never worked correctly and this should be handled with an
API to systemd going forward.
seunshare: Try to use setcurrent before setexec

If seunshare uses PR_SET_NO_NEW_PRIVS, which certain versions of
libcap-ng set, setexeccon will cause execve to fail.  This also
makes setting selinux context the very last action taken by
seunshare prior to exec, as it may otherwise cause things to fail.

Note that this won't work without adjusting the system policy to
allow this use of setcurrent.  This rule appears to work:

    allow unconfined_t sandbox_t:process dyntransition;

although a better rule would probably relax the unconfined_t
restriction.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
libselinux: fix typo in man page
libsemanage: fix src/pywrap-test.py -v -F

Running "libsemanage/src/pywrap-test.py -v -F" gives following error:

    Traceback (most recent call last):
      File "pywrap-test.py", line 1139, in <module>
        sys.exit(main())
      File "pywrap-test.py", line 1121, in main
        tests.run(sh)
      File "pywrap-test.py", line 107, in run
        self.test_writefcontext(handle)
      File "pywrap-test.py", line 622, in test_writefcontext
        if self.verbose: print "SEFContext type set: ", semanage.semanage_fcontext_get_type_str(fcon)
    TypeError: in method 'semanage_fcontext_get_type_str', argument 1 of type 'int'

The argument of semanage_fcontext_get_type_str is the type recorded in
fcon and not fcon itself.  This type can be retrieved with
semanage_fcontext_get_type.
libsemanage: use semanage_bool_get_value to print a boolean

... and not semanage_bool_set_value.

This fixes "python2 pywrap-test.py -v -B -C"
Add db_exception and db_datatype support to label_db backend

Hi,

in https://github.com/TresysTechnology/refpolicy/pull/1 db_exception
and db_datatype were added to reference policy. This small patch
extends ability of label_db backend to work with these objects.

Regards.
Log an error on unknown classes and permissions.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Add pcre version string to the compiled file_contexts format.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Deprecate use of flask.h and av_permissions.h.

Also remove all internal uses by libselinux.
This requires deleting the old class/perm string lookup tables
and compatibility code for kernels that predate the /sys/fs/selinux/class
tree, i.e. Linux < 2.6.23.

This also fixes a longstanding bug in the stringrep code; it was allocating
NVECTORS (number of vectors in the legacy av_perm_to_string table, i.e.
the total number of legacy permissions) entries in the per-class perms array
rather than MAXVECTORS (the maximum number of permissions in any
access vector).  Ho hum.  I already fixed this in Android but forgot it
here.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Skip policy module re-link when only setting booleans.

Since booleans are only set, not added/removed, we do not need to re-link
modules when setting them.  We can instead just take the existing binary
policy and mutate it for the new values.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
libsemanage: fix deprecation warning for bison

The %name-prefix="foo" syntax was deprecated in bison 2.3b [1], which
was released in 2006. This patches fixes the syntax to use the newer
syntax. This breaks support for older versions of bison.

[1] http://lists.gnu.org/archive/html/help-bison/2009-10/msg00018.html

Reported-by: Ilya Frolov <ilya.a.frolov@gmail.com>
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libselinux: Compiled file context files and the original should have the same permissions

Currently the compiled file context files can end up with different
permissions then the original.  This can lead to non priv users
not being able to read the compiled versions.
sepolgen: remove unnecessary grammar in interface call param list

The addition of this rule caused interface vectors to be less accurate.
The grammar looks correct without the rule, so remove it.

Reverted hunk from commit 17cc87e56b0241688c119f774f103622b002e0ae

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: fix typo in tests makefile -o -> -O

Fixed typo in the tests Makefile where '-o' should have been '-O'.

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: only try to compile file contexts if they exist

It is not a requirement that all file context files exists (e.g.
file_contexts.local is not mandatory). However, sefcontext_compile is
executed for all file contexts files regardless of existance, which
results in an error when they do not exist and causes policy load to
fail. This modifies libsemanage so that sefcontext_compile is only
executed on file contexts that do exist.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: fix memory leak when setting a custom store_path

A strdup was setting store_path without freeing the original
value in the semanage conf.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Revert "libsemanage: Cleanup/fix enable/disable/remove module."

This reverts commit c9b09be4244f3c90cee19d9e3feca324f0e0e636.
Revert "libsemanage: Use default semanage.conf as a fallback"

This reverts commit 4120df1c6ea85aa56ed602e46a4030d9e4e45ee6.