|
 |
10e40a |
From 72c7e9123980b003a21d51e2805529a3e90b2460 Mon Sep 17 00:00:00 2001
|
|
|
10e40a |
From: Vit Mojzis <vmojzis@redhat.com>
|
|
|
10e40a |
Date: Thu, 13 Oct 2022 17:33:18 +0200
|
|
|
10e40a |
Subject: [PATCH] python: Harden tools against "rogue" modules
|
|
|
10e40a |
|
|
|
10e40a |
Python scripts present in "/usr/sbin" override regular modules.
|
|
|
10e40a |
Make sure /usr/sbin is not present in PYTHONPATH.
|
|
|
10e40a |
|
|
|
10e40a |
Fixes:
|
|
|
10e40a |
#cat > /usr/sbin/audit.py <
|
|
|
10e40a |
import sys
|
|
|
10e40a |
print("BAD GUY!", file=sys.stderr)
|
|
|
10e40a |
sys.exit(1)
|
|
|
10e40a |
EOF
|
|
|
10e40a |
#semanage boolean -l
|
|
|
10e40a |
BAD GUY!
|
|
|
10e40a |
|
|
|
10e40a |
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
|
|
10e40a |
---
|
|
|
10e40a |
python/audit2allow/audit2allow | 2 +-
|
|
|
10e40a |
python/audit2allow/sepolgen-ifgen | 2 +-
|
|
|
10e40a |
python/chcat/chcat | 2 +-
|
|
|
10e40a |
python/semanage/semanage | 2 +-
|
|
|
10e40a |
python/sepolicy/sepolicy.py | 2 +-
|
|
|
10e40a |
5 files changed, 5 insertions(+), 5 deletions(-)
|
|
|
10e40a |
|
|
|
10e40a |
diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
|
|
|
10e40a |
index 09b06f66..eafeea88 100644
|
|
|
10e40a |
--- a/python/audit2allow/audit2allow
|
|
|
10e40a |
+++ b/python/audit2allow/audit2allow
|
|
|
10e40a |
@@ -1,4 +1,4 @@
|
|
|
10e40a |
-#!/usr/bin/python3 -Es
|
|
|
10e40a |
+#!/usr/bin/python3 -EsI
|
|
|
10e40a |
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
|
10e40a |
# Authors: Dan Walsh <dwalsh@redhat.com>
|
|
|
10e40a |
#
|
|
|
10e40a |
diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen
|
|
|
10e40a |
index be2d093b..f25f8af1 100644
|
|
|
10e40a |
--- a/python/audit2allow/sepolgen-ifgen
|
|
|
10e40a |
+++ b/python/audit2allow/sepolgen-ifgen
|
|
|
10e40a |
@@ -1,4 +1,4 @@
|
|
|
10e40a |
-#!/usr/bin/python3 -Es
|
|
|
10e40a |
+#!/usr/bin/python3 -EsI
|
|
|
10e40a |
#
|
|
|
10e40a |
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
|
10e40a |
#
|
|
|
10e40a |
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
|
|
10e40a |
index df2509f2..5671cec6 100755
|
|
|
10e40a |
--- a/python/chcat/chcat
|
|
|
10e40a |
+++ b/python/chcat/chcat
|
|
|
10e40a |
@@ -1,4 +1,4 @@
|
|
|
10e40a |
-#!/usr/bin/python3 -Es
|
|
|
10e40a |
+#!/usr/bin/python3 -EsI
|
|
|
10e40a |
# Copyright (C) 2005 Red Hat
|
|
|
10e40a |
# see file 'COPYING' for use and warranty information
|
|
|
10e40a |
#
|
|
|
10e40a |
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
|
|
10e40a |
index b8842d28..1f170f60 100644
|
|
|
10e40a |
--- a/python/semanage/semanage
|
|
|
10e40a |
+++ b/python/semanage/semanage
|
|
|
10e40a |
@@ -1,4 +1,4 @@
|
|
|
10e40a |
-#!/usr/bin/python3 -Es
|
|
|
10e40a |
+#!/usr/bin/python3 -EsI
|
|
|
10e40a |
# Copyright (C) 2012-2013 Red Hat
|
|
|
10e40a |
# AUTHOR: Miroslav Grepl <mgrepl@redhat.com>
|
|
|
10e40a |
# AUTHOR: David Quigley <selinux@davequigley.com>
|
|
|
10e40a |
diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
|
|
|
10e40a |
index 8bd6a579..0c1d9641 100755
|
|
|
10e40a |
--- a/python/sepolicy/sepolicy.py
|
|
|
10e40a |
+++ b/python/sepolicy/sepolicy.py
|
|
|
10e40a |
@@ -1,4 +1,4 @@
|
|
|
10e40a |
-#!/usr/bin/python3 -Es
|
|
|
10e40a |
+#!/usr/bin/python3 -EsI
|
|
|
10e40a |
# Copyright (C) 2012 Red Hat
|
|
|
10e40a |
# AUTHOR: Dan Walsh <dwalsh@redhat.com>
|
|
|
10e40a |
# see file 'COPYING' for use and warranty information
|
|
|
10e40a |
--
|
|
|
10e40a |
2.37.3
|
|
|
10e40a |
|