rpmlint

[Steve Grubb <sgrubb@redhat.com>]

Hi,

Below is a patch that I am thinking about submitting to rpmlint. The main idea
of this patch is to catch places where people might be coding policy knowledge
into scripts. Chcon would require knowing some types in order to work. If the
types ever got changed, the script would break. Can anyone think of other
things we do not want to see in rpm scriplets?

-Steve


diff -ur rpmlint-0.78.orig/PostCheck.py rpmlint-0.78/PostCheck.py
--- rpmlint-0.78.orig/PostCheck.py	2006-11-01 11:13:04.000000000 -0500
+++ rpmlint-0.78/PostCheck.py	2006-11-01 12:26:49.000000000 -0500
@@ -38,6 +38,7 @@
 bracket_regex=re.compile('^[^#]*if.*[^ :\]]\]', re.MULTILINE)
 home_regex=re.compile('[^a-zA-Z]+~/|\${?HOME(\W|$)', re.MULTILINE)
 dangerous_command_regex=re.compile("(^|[;\|`]|&&|$\()\s*(?:\S*/s?bin/)?(cp|mv|ln|tar|rpm|chmod|chown|rm|cpio|install|perl|userdel|groupdel)\s", re.MULTILINE)
+selinux_regex=re.compile("(^|[;\|`]|&&|$\()\s*(?:\S*/s?bin/)?(chcon|runcon)\s", re.MULTILINE)
 single_command_regex=re.compile("^[ \n]*([^ \n]+)[ \n]*$")
 update_menu_regex=re.compile('update-menus', re.MULTILINE)
 tmp_regex=re.compile('\s(/var)?/tmp', re.MULTILINE)
@@ -139,6 +140,10 @@
                 res=dangerous_command_regex.search(script)
                 if res:
                     printWarning(pkg, 'dangerous-command-in-' + tag[2], res.group(2))
+                res=selinux_regex.search(script)
+                if res:
+                    printError(pkg, 'selinux-forbidden-command-in-' + tag[2], res.group(2))
+
                 if update_menu_regex.search(script):
                     menu_error=1
                     for f in files:

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.