Skip to content
Snippets Groups Projects
Commit 5b4e5750 authored by Rocky Automation's avatar Rocky Automation :tv:
Browse files

import passt-0%5e20230222.g4ddbcb9-2.el9_2

parents
No related branches found
Tags imports/r10s/aardvark-dns-1.11.0-3.el10
No related merge requests found
Hide whitespace changes
Inline Side-by-side
SOURCES/0019-contrib-selinux-Split-interfaces-into-smaller-bits.patch 0 → 100644
+ 120
− 0
View file @ 5b4e5750
From 80978901354b17cf3460d5d4451b48b59a9204ae Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Fri, 10 Mar 2023 17:00:31 +0000
Subject: [PATCH 19/20] contrib/selinux: Split interfaces into smaller bits
...to fit accepted Fedora practices.
Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
(cherry picked from commit 93105ea06619d4c199f8140f4b75ae359757dc6d)
---
contrib/selinux/passt.if | 71 ++++++++++++++++++++++++++++++++++------
1 file changed, 61 insertions(+), 10 deletions(-)
diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
index 3e37c5b..f7560a7 100644
--- a/contrib/selinux/passt.if
+++ b/contrib/selinux/passt.if
@@ -17,37 +17,88 @@ interface(`passt_domtrans',`
domtrans_pattern($1, passt_exec_t, passt_t)
')
-interface(`passt_socket',`
+interface(`passt_socket_dir',`
+ gen_require(`
+ type passt_t;
+ ')
+
+ allow passt_t $1:dir add_entry_dir_perms;
+')
+
+interface(`passt_socket_create',`
+ gen_require(`
+ type passt_t;
+ ')
+
+ allow passt_t $1:sock_file create;
+')
+
+interface(`passt_socket_use',`
gen_require(`
type passt_t;
')
- allow $1 $2:sock_file write;
allow $1 passt_t:unix_stream_socket connectto;
+ allow $1 $2:sock_file { read write };
+ allow passt_t $2:sock_file { read write };
+')
+
+interface(`passt_socket_delete',`
+ gen_require(`
+ type passt_t;
+ ')
+
+ allow $1 $2:sock_file unlink;
+')
+
+interface(`passt_logfile_dir',`
+ gen_require(`
+ type passt_t;
+ ')
- allow passt_t $2:sock_file { create read write unlink };
+ allow passt_t $1:dir add_entry_dir_perms;
')
-interface(`passt_logfile',`
+interface(`passt_logfile_use',`
gen_require(`
type passt_t;
')
logging_log_file($1);
- allow passt_t $1:dir { search write add_name };
allow passt_t $1:file { create open read write };
')
-interface(`passt_pidfile',`
+interface(`passt_pidfile_dir',`
+ gen_require(`
+ type passt_t;
+ ')
+
+ allow passt_t $1:dir add_entry_dir_perms;
+')
+
+interface(`passt_pidfile_write',`
+ gen_require(`
+ type passt_t;
+ ')
+
+ files_pid_file($1);
+ allow passt_t $1:file { create open write };
+')
+
+interface(`passt_pidfile_read',`
gen_require(`
type passt_t;
')
- allow $1 $2:file { open read unlink };
+ allow $1 $2:file { open read };
+')
+
+interface(`passt_pidfile_delete',`
+ gen_require(`
+ type passt_t;
+ ')
- files_pid_file($2);
- allow passt_t $2:dir { search write add_name };
- allow passt_t $2:file { create open write };
+ allow $1 $2:file unlink;
')
interface(`passt_kill',`
--
2.39.2
SOURCES/0020-fedora-Install-SELinux-interface-files-to-shared-inc.patch 0 → 100644
+ 40
− 0
View file @ 5b4e5750
From 61676035ec5f58df4f4cca024c772d7e0b43d7dc Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Fri, 10 Mar 2023 19:10:01 +0100
Subject: [PATCH 20/20] fedora: Install SELinux interface files to shared
include directory
Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
(cherry picked from commit 70c0765b49e19b76639908a7686d8f795ba3ed24)
---
contrib/fedora/passt.spec | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index 7f67bee..51cad90 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -61,7 +61,9 @@ ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx
pushd contrib/selinux
make -f %{_datadir}/selinux/devel/Makefile
install -p -m 644 -D passt.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/passt.pp
+install -p -m 644 -D passt.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/passt.if
install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/pasta.pp
+install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if
popd
%post selinux
@@ -93,7 +95,9 @@ semodule -r pasta 2>/dev/null || :
%files selinux
%dir %{_datadir}/selinux/packages/%{name}
%{_datadir}/selinux/packages/%{name}/passt.pp
+%{_datadir}/selinux/devel/include/contrib/passt.if
%{_datadir}/selinux/packages/%{name}/pasta.pp
+%{_datadir}/selinux/devel/include/contrib/pasta.if
%changelog
{{{ passt_git_changelog }}}
--
2.39.2
SPECS/passt.spec 0 → 100644
+ 240
− 0
View file @ 5b4e5750
# PASST - Plug A Simple Socket Transport
# for qemu/UNIX domain socket mode
#
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
%global git_hash 4ddbcb9c0c555838b123c018a9ebc9b7e14a87e5
%global selinuxtype targeted
Name: passt
Version: 0^20230222.g4ddbcb9
Release: 2%{?dist}
Summary: User-mode networking daemons for virtual machines and namespaces
License: AGPLv3+ and BSD
Group: System Environment/Daemons
URL: https://passt.top/
Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
Patch1: 0001-udp-Actually-use-host-resolver-to-forward-DNS-querie.patch
Patch2: 0002-conf-Split-add_dns-4-6-out-of-get_dns.patch
Patch3: 0003-conf-udp-Allow-any-loopback-address-to-be-used-as-re.patch
Patch4: 0004-tcp-tcp_splice-Get-rid-of-false-positive-CWE-394-Cov.patch
Patch5: 0005-tcp-Avoid-false-but-convoluted-positive-Coverity-CWE.patch
Patch6: 0006-tcp-Avoid-theoretical-resource-leak-CWE-772-Coverity.patch
Patch7: 0007-Fix-definitions-of-SOCKET_MAX-TCP_MAX_CONNS.patch
Patch8: 0008-doc-demo-Fix-and-suppress-ShellCheck-warnings.patch
Patch9: 0009-contrib-selinux-Drop-duplicate-init_daemon_domain-ru.patch
Patch10: 0010-contrib-selinux-Let-passt-write-to-stdout-and-stderr.patch
Patch11: 0011-contrib-selinux-Allow-binding-and-connecting-to-all-.patch
Patch12: 0012-contrib-selinux-Let-interface-users-set-paths-for-lo.patch
Patch13: 0013-tcp-udp-util-Pass-socket-creation-errors-all-the-way.patch
Patch14: 0014-tcp-udp-Fix-partial-success-return-codes-in-tcp-udp-.patch
Patch15: 0015-conf-Terminate-on-EMFILE-or-ENFILE-on-sockets-for-po.patch
Patch16: 0016-tcp-Clamp-MSS-value-when-queueing-data-to-tap-also-f.patch
Patch17: 0017-contrib-selinux-Drop-example-from-headers-this-is-th.patch
Patch18: 0018-contrib-selinux-Drop-unused-passt_read_data-interfac.patch
Patch19: 0019-contrib-selinux-Split-interfaces-into-smaller-bits.patch
Patch20: 0020-fedora-Install-SELinux-interface-files-to-shared-inc.patch
BuildRequires: gcc, make, git, checkpolicy, selinux-policy-devel
Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
%description
passt implements a translation layer between a Layer-2 network interface and
native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't
require any capabilities or privileges, and it can be used as a simple
replacement for Slirp.
pasta (same binary as passt, different command) offers equivalent functionality,
for network namespaces: traffic is forwarded using a tap interface inside the
namespace, without the need to create further interfaces on the host, hence not
requiring any capabilities or privileges.
%package selinux
BuildArch: noarch
Summary: SELinux support for passt and pasta
Requires: %{name} = %{version}-%{release}
Requires: selinux-policy
Requires(post): %{name}
Requires(post): policycoreutils
Requires(preun): %{name}
Requires(preun): policycoreutils
%description selinux
This package adds SELinux enforcement to passt(1) and pasta(1).
%prep
%autosetup -S git_am -n passt-%{git_hash}
%build
%set_build_flags
%make_build VERSION="%{version}-%{release}.%{_arch}"
%install
%make_install DESTDIR=%{buildroot} prefix=%{_prefix} bindir=%{_bindir} mandir=%{_mandir} docdir=%{_docdir}/%{name}
%ifarch x86_64
ln -sr %{buildroot}%{_mandir}/man1/passt.1 %{buildroot}%{_mandir}/man1/passt.avx2.1
ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx2.1
%endif
pushd contrib/selinux
make -f %{_datadir}/selinux/devel/Makefile
install -p -m 644 -D passt.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/passt.pp
install -p -m 644 -D passt.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/passt.if
install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/pasta.pp
install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if
popd
%pre selinux
%selinux_relabel_pre -s %{selinuxtype}
%post selinux
semodule -i %{_datadir}/selinux/packages/%{name}/passt.pp 2>/dev/null || :
semodule -i %{_datadir}/selinux/packages/%{name}/pasta.pp 2>/dev/null || :
%selinux_relabel_post -s %{selinuxtype}
%preun selinux
semodule -r passt 2>/dev/null || :
semodule -r pasta 2>/dev/null || :
%selinux_relabel_post -s %{selinuxtype}
%files
%license LICENSES/{AGPL-3.0-or-later.txt,BSD-3-Clause.txt}
%dir %{_docdir}/%{name}
%doc %{_docdir}/%{name}/README.md
%doc %{_docdir}/%{name}/demo.sh
%{_bindir}/passt
%{_bindir}/pasta
%{_bindir}/qrap
%{_mandir}/man1/passt.1*
%{_mandir}/man1/pasta.1*
%{_mandir}/man1/qrap.1*
%ifarch x86_64
%{_bindir}/passt.avx2
%{_mandir}/man1/passt.avx2.1*
%{_bindir}/pasta.avx2
%{_mandir}/man1/pasta.avx2.1*
%endif
%files selinux
%dir %{_datadir}/selinux/packages/%{name}
%{_datadir}/selinux/packages/%{name}/passt.pp
%{_datadir}/selinux/devel/include/contrib/passt.if
%{_datadir}/selinux/packages/%{name}/pasta.pp
%{_datadir}/selinux/devel/include/contrib/pasta.if
%changelog
* Thu Mar 16 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230222.g4ddbcb9-2
- udp: Actually use host resolver to forward DNS queries (rhbz#2177075)
- conf: Split add_dns{4,6}() out of get_dns() (rhbz#2177075)
- conf, udp: Allow any loopback address to be used as resolver (rhbz#2177075)
- tcp, tcp_splice: Get rid of false positive CWE-394 Coverity warning from fls() (rhbz#2177084)
- tcp: Avoid false (but convoluted) positive Coverity CWE-476 warning (rhbz#2177084)
- tcp: Avoid (theoretical) resource leak (CWE-772) Coverity warning (rhbz#2177084)
- Fix definitions of SOCKET_MAX, TCP_MAX_CONNS (rhbz#2177084)
- doc/demo: Fix and suppress ShellCheck warnings (rhbz#2177084)
- contrib/selinux: Drop duplicate init_daemon_domain() rule (rhbz#2176813)
- contrib/selinux: Let passt write to stdout and stderr when it starts (rhbz#2176813)
- contrib/selinux: Allow binding and connecting to all UDP and TCP ports (rhbz#2176813)
- contrib/selinux: Let interface users set paths for log, PID, socket files (rhbz#2176813)
- contrib/selinux: Drop "example" from headers: this is the actual policy (rhbz#2176813)
- contrib/selinux: Drop unused passt_read_data() interface (rhbz#2176813)
- contrib/selinux: Split interfaces into smaller bits (rhbz#2176813)
- fedora: Install SELinux interface files to shared include directory (rhbz#2176813)
- tcp, udp, util: Pass socket creation errors all the way up (rhbz#2177080)
- tcp, udp: Fix partial success return codes in {tcp,udp}_sock_init() (rhbz#2177080)
- conf: Terminate on EMFILE or ENFILE on sockets for port mapping (rhbz#2177080)
- tcp: Clamp MSS value when queueing data to tap, also for pasta (rhbz#2177083)
- Fix up SELinux labels on install/uninstall, require matching -selinux package (rhbz#2176813)
- Resolves: rhbz#2177075 rhbz#2177084 rhbz#2177080 rhbz#2177083 rhbz#2176813
* Wed Feb 22 2023 Camilla Conte <cconte@redhat.com> - 0^20230222.g4ddbcb9-1
- Import from fedora to CentOS/RHEL
- Resolves: rhbz#2172244
* Wed Nov 16 2022 Miroslav Rezanina <mrezanin@redhat.com> - 0^20221110.g4129764-1
- Import from fedora to CentOS/RHEL
- Resolves: rhbz#2131015
* Thu Nov 10 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221110.g4129764-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_04.e308018..2022_11_10.4129764
* Fri Nov 4 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221104.ge308018-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_26.f212044..2022_11_04.e308018
* Wed Oct 26 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221026.gf212044-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_26.e4df8b0..2022_10_26.f212044
* Wed Oct 26 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221026.ge4df8b0-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_24.c11277b..2022_10_26.e4df8b0
* Mon Oct 24 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221024.gc11277b-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_22.b68da10..2022_10_24.c11277b
* Sat Oct 22 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221022.gb68da10-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_15.b3f3591..2022_10_22.b68da10
* Sat Oct 15 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221015.gb3f3591-1
- Add versioning information
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_09_29.06aa26f..2022_10_15.b3f3591
* Thu Sep 29 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220929.g06aa26f-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_09_24.8978f65..2022_09_29.06aa26f
* Sat Sep 24 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220924.g8978f65-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_09_23.d6f865a..2022_09_24.8978f65
* Fri Sep 23 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220923.gd6f865a-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_09_06.e2cae8f..2022_09_23.d6f865a
* Wed Sep 7 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220907.ge2cae8f-1
- Escape %% characters in spec file's changelog
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_09_01.7ce9fd1..2022_09_06.e2cae8f
* Fri Sep 2 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220902.g7ce9fd1-1
- Add selinux-policy Requires: tag
- Add %%dir entries for own SELinux policy directory and documentation
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_08_29.0cb795e..2022_09_01.7ce9fd1
* Tue Aug 30 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220830.g0cb795e-1
- Pass explicit bindir, mandir, docdir, and drop OpenSUSE override
- Use full versioning for SELinux subpackage Requires: tag
- Define git_hash in spec file and reuse it
- Drop comment stating the spec file is an example file
- Drop SPDX identifier from spec file
- Adopt versioning guideline for snapshots
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_08_24.60ffc5b..2022_08_29.0cb795e
* Wed Aug 24 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220824.g60ffc5b-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_08_21.7b71094..2022_08_24.60ffc5b
* Sun Aug 21 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220821.g7b71094-1
- Use more GNU-style directory variables, explicit docdir for OpenSUSE
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_08_20.f233d6c..2022_08_21.7b71094
* Sat Aug 20 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220820.gf233d6c-1
- Fix man pages wildcards in spec file
- Don't hardcode CFLAGS setting, use %%set_build_flags macro instead
- Build SELinux subpackage as noarch
- Change source URL to HEAD link with explicit commit SHA
- Drop VCS tag from spec file
- Start Release tag from 1, not 0
- Introduce own rpkg macro for changelog
- Install "plain" README, instead of web version, and demo script
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_08_04.b516d15..2022_08_20.f233d6c
* Mon Aug 1 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220801.gb516d15-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_07_20.9af2e5d..2022_08_04.b516d15
* Wed Jul 20 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220720.g9af2e5d-1
- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_07_14.b86cd00..2022_07_20.9af2e5d
* Thu Jul 14 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20220714.gb86cd00-1
- Use pre-processing macros in spec file
- Drop dashes from version
- Add example spec file for Fedora
- Upstream changes: https://passt.top/passt/log/?qt=range&q=e653f9b3ed1b60037e3bc661d53b3f9407243fc2..2022_07_14.b86cd00
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment