Changelog
sepolgen (1.0.18-1) unstable; urgency=low
* New upstream point release. Add support for Xen ocontexts from Paul
Nuzzi.
sepolgen (1.0.17-3) unstable; urgency=low
* [a1816e2]: [topic--audit-msg-fix]: fix detection of policy loads
Originally audit2allow used the avc: allowed message generated by
auditallow statement for load_policy to identify policy reloads.
Later it was switched to use the MAC_POLICY_LOAD events generated by
the audit framework. Those events should still get logged via printk
if auditd is not running, but it appears that the code
(audit_printk_skb) will then log the type= field as an integer
rather than a string, and audit2allow/sepolgen only looks for the
string MAC_POLICY_LOAD. So I suspect that this would be resolved by
modifying sepolgen/audit.py to also match on type=1403 for load
messages.
Bug fix: "audit2allow -l doesn't work", thanks to Russell Coker
(Closes: #503252).
sepolgen (1.0.17-2) unstable; urgency=low
* [8ed32c1]:policycoreutils, sepolgen (sepolgen-ifgen) issues
I am running into an issue with sepolgen. Debian ships more
than one version of the refpolicy, a default one, and a MLS enabled
one. So, the include files live in either
/usr/share/selinux/{default,mls}/include sepolgen (in
src/sepolgen/defaults.py) sets refpolicy_devel() to a single
location -- and thus, only one version of the security policy may be
supported. So, sepolgen-ifgen from policycoreutils can only work
with one policy, which may not be the one installed on the target
machine. Could this be made configurable, somehow? As far as I can
see, sepolgen's python library does not offer any way to set the
value. This change fixes that. Now you may set the path to look for
development headers in /etc/selinux/sepolgen.conf, in the variable
SELINUX_DEVEL_PATH. The builtin default will have it work on Debian
and fedora machines out of the box.
Bug fix: "sepolgen-ifgen fails", thanks to Martin Godisch
(Closes: #534305).
-- Ubuntu Archive Auto-Sync <email address hidden> Fri, 06 Nov 2009 10:34:36 +0000
