3.1 release notes draft

3.1 release notes draft

[Petr Lautrbach]

I'd like to release 3.1 today/tommorow to open the development of other
performance related improvemenets which which postponed. This is release notes
draft which is based on RELEASE-20200518.txt and RELEASE-20200619.txt:

RELEASE 202007XX (3.1)

User-visible changes:

* selinux/flask.h and selinux/av_permissions.h were removed

  The flask.h and av_permissions.h header files were deprecated and
  all selinux userspace references to them were removed in
  commit 76913d8adb61b5 ("Deprecate use of flask.h and av_permissions.h.")
  back in 2014 and included in the 20150202 / 2.4 release.
  All userspace object managers should have been updated
  to use the dynamic class/perm mapping support since that time.
  Remove these headers finally to ensure that no users remain and
  that no future uses are ever introduced.

  Use string_to_security_class(3) and string_to_av_perm(3) to map the class and
  permission names to their policy values, or selinux_set_mapping(3) to create a
  mapping from class and permission index values used by the application to the
  policy values.

* Support for new polcap genfs_seclabel_symlinks

* New `setfiles -E` option - treat conflicting specifications as errors, such
as where two hardlinks for the same inode have different contexts.

* `restorecond_user.service` - new systemd user service which runs `restorecond -u`

* `setsebool -V` reports errors from commit phase

* Improved man pages

* `semanage` uses ipaddress Python module instead of IPy

* matchpathcon related interfaces are deprecated

* selinuxfs is mounted with noexec and nosuid

* Improved README which was renamed to README.md and converted to markdown.

* `setup.py` builds can be customized using PYTHON_SETUP_ARGS, e.g. to for
  Debian Python layout use: `make PYTHON_SETUP_ARGS=--install-layout=deb ...`

* the dso wrappers for internal calls were removed and it is now strongly recommended to CFLAGS with
  `-fno-semantic-interposition`

* `security_compute_user()` was deprecated - usage of /sys/fs/selinux/user { security:compute_user } might be revisited

* checkpolicy treats invalid characters as an error - it might break (but intentional) rare use cases

* New `restorecon -x` option - prevent `restorecon` from crossing file system
  boundaries.

* Handle `semanage module` in semanage bash completion

* Added section about CFLAGS to README.md, see Packaging-relevant changes

* Improved man pages

* Add Travis CI job to run SELinux kernel testsuite on latest Fedora cloud image

* `sepolgen-ifgen` parses a gen_tunable statement as bool

* `semanage` handles getprotobyname() failure case on Debian where /etc/protocols does not contain an entry for "ipv4"

Packaging-relevant changes:

* Setting CFLAGS during the make process will cause the omission of many defaults. While the project strives
  to provide a reasonable set of default flags, custom CFLAGS could break the build, or have other undesired
  changes on the build output. Thus, be very careful when setting CFLAGS. CFLAGS that are encouraged to be
  set when overriding are:

  - -fno-semantic-interposition for gcc or compilers that do not do this. clang does this by default. clang-10 and up
    will support passing this flag, but ignore it. Previous clang versions fail.

Issues fixed:

* https://github.com/SELinuxProject/selinux/issues/248
* https://github.com/SELinuxProject/selinux/issues/239
* https://github.com/SELinuxProject/selinux/issues/237
* https://github.com/SELinuxProject/selinux/issues/225
* https://github.com/SELinuxProject/selinux/issues/217
* https://github.com/SELinuxProject/selinux/issues/208
* https://github.com/SELinuxProject/selinux/issues/204
* https://github.com/SELinuxProject/selinux/issues/187
* https://github.com/SELinuxProject/selinux/issues/179
* https://github.com/SELinuxProject/selinux/issues/164
* https://github.com/SELinuxProject/selinux/issues/70
* https://github.com/SELinuxProject/selinux/issues/28

[PATCH] Update VERSIONs and Python bindings version to 3.1 for release

[Petr Lautrbach]

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
---
 checkpolicy/VERSION      | 2 +-
 dbus/VERSION             | 2 +-
 gui/VERSION              | 2 +-
 libselinux/VERSION       | 2 +-
 libselinux/src/setup.py  | 2 +-
 libsemanage/VERSION      | 2 +-
 libsepol/VERSION         | 2 +-
 mcstrans/VERSION         | 2 +-
 policycoreutils/VERSION  | 2 +-
 python/VERSION           | 2 +-
 python/sepolgen/VERSION  | 2 +-
 python/sepolicy/setup.py | 2 +-
 restorecond/VERSION      | 2 +-
 sandbox/VERSION          | 2 +-
 secilc/VERSION           | 2 +-
 semodule-utils/VERSION   | 2 +-
 16 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/checkpolicy/VERSION b/checkpolicy/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/checkpolicy/VERSION
+++ b/checkpolicy/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/dbus/VERSION b/dbus/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/dbus/VERSION
+++ b/dbus/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/gui/VERSION b/gui/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/gui/VERSION
+++ b/gui/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/libselinux/VERSION b/libselinux/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/libselinux/VERSION
+++ b/libselinux/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/libselinux/src/setup.py b/libselinux/src/setup.py
index c8270bdc1c53..1b97ed8c0434 100644
--- a/libselinux/src/setup.py
+++ b/libselinux/src/setup.py
@@ -4,7 +4,7 @@ from distutils.core import Extension, setup
 
 setup(
     name="selinux",
-    version="3.0",
+    version="3.1",
     description="SELinux python 3 bindings",
     author="SELinux Project",
     author_email="selinux@vger.kernel.org",
diff --git a/libsemanage/VERSION b/libsemanage/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/libsemanage/VERSION
+++ b/libsemanage/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/libsepol/VERSION b/libsepol/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/libsepol/VERSION
+++ b/libsepol/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/mcstrans/VERSION b/mcstrans/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/mcstrans/VERSION
+++ b/mcstrans/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/policycoreutils/VERSION b/policycoreutils/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/policycoreutils/VERSION
+++ b/policycoreutils/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/python/VERSION b/python/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/python/VERSION
+++ b/python/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/python/sepolgen/VERSION b/python/sepolgen/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/python/sepolgen/VERSION
+++ b/python/sepolgen/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py
index fa60ef6ce386..b943e14621c7 100644
--- a/python/sepolicy/setup.py
+++ b/python/sepolicy/setup.py
@@ -6,7 +6,7 @@ from distutils.core import setup
 
 setup(
     name="sepolicy",
-    version="3.0",
+    version="3.1",
     description="Python SELinux Policy Analyses bindings",
     author="Daniel Walsh",
     author_email="dwalsh@redhat.com",
diff --git a/restorecond/VERSION b/restorecond/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/restorecond/VERSION
+++ b/restorecond/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/sandbox/VERSION b/sandbox/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/sandbox/VERSION
+++ b/sandbox/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/secilc/VERSION b/secilc/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/secilc/VERSION
+++ b/secilc/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
diff --git a/semodule-utils/VERSION b/semodule-utils/VERSION
index 0ff4b45d1bf9..8c50098d8aed 100644
--- a/semodule-utils/VERSION
+++ b/semodule-utils/VERSION
@@ -1 +1 @@
-3.1-rc2
+3.1
-- 
2.26.2

Re: 3.1 release notes draft

[Stephen Smalley]

On Thu, Jul 9, 2020 at 5:46 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>
>
> I'd like to release 3.1 today/tommorow to open the development of other
> performance related improvemenets which which postponed. This is release notes
> draft which is based on RELEASE-20200518.txt and RELEASE-20200619.txt:
>
> RELEASE 202007XX (3.1)
>
> User-visible changes:
>
> * selinux/flask.h and selinux/av_permissions.h were removed

Also sepol/policydb/flask.h although hopefully there were no external
users of it.

> * `security_compute_user()` was deprecated - usage of /sys/fs/selinux/user { security:compute_user } might be revisited

Not sure what the last part "might be revisited" means; we have
removed all uses of it internal to libselinux and deprecated the
interface, with the intent of someday dropping it altogether and
removing the kernel interface.

One other user-visible change is commit
8677ce5e8f592950ae6f14cea1b68a20ddc1ac25 ("libsepol,checkpolicy:
support omitting unused initial sid contexts") which allows policies
to start omitting unused initial SID contexts going forward, as per
its description and
https://github.com/SELinuxProject/selinux-kernel/issues/12.

Re: 3.1 release notes draft

[Ondrej Mosnacek]

Hi,

a couple nits below...

On Thu, Jul 9, 2020 at 11:45 AM Petr Lautrbach <plautrba@redhat.com> wrote:
[...]
>
> * Support for new polcap genfs_seclabel_symlinks

s/polcap/policy capability/ ?

>
> * New `setfiles -E` option - treat conflicting specifications as errors, such
> as where two hardlinks for the same inode have different contexts.
>
> * `restorecond_user.service` - new systemd user service which runs `restorecond -u`
>
> * `setsebool -V` reports errors from commit phase
>
> * Improved man pages
>
> * `semanage` uses ipaddress Python module instead of IPy
>
> * matchpathcon related interfaces are deprecated
>
> * selinuxfs is mounted with noexec and nosuid
>
> * Improved README which was renamed to README.md and converted to markdown.

This is more of a developer/packager/builder visible change rather
than user visible IMHO. Maybe move it to a "Development-related
changes" section?

>
> * `setup.py` builds can be customized using PYTHON_SETUP_ARGS, e.g. to for
>   Debian Python layout use: `make PYTHON_SETUP_ARGS=--install-layout=deb ...`

Ditto. Maybe the "Packaging-relevant changes" would fit better for this one?

>
> * the dso wrappers for internal calls were removed and it is now strongly recommended to CFLAGS with
>   `-fno-semantic-interposition`
>
> * `security_compute_user()` was deprecated - usage of /sys/fs/selinux/user { security:compute_user } might be revisited
>
> * checkpolicy treats invalid characters as an error - it might break (but intentional) rare use cases

I'd reword this to "might break rare use cases (intentionally)".

>
> * New `restorecon -x` option - prevent `restorecon` from crossing file system
>   boundaries.

"New `restorecon -x` option, which prevents it from crossing file
system boundaries"?

>
> * Handle `semanage module` in semanage bash completion
>
> * Added section about CFLAGS to README.md, see Packaging-relevant changes

Also mainly devel/packager-related.

>
> * Improved man pages

This one is already listed further above .

>
> * Add Travis CI job to run SELinux kernel testsuite on latest Fedora cloud image

Another purely development-related change.

>
> * `sepolgen-ifgen` parses a gen_tunable statement as bool
>
> * `semanage` handles getprotobyname() failure case on Debian where /etc/protocols does not contain an entry for "ipv4"
>
> Packaging-relevant changes:
[...]

Thank you for working on the release!

--
Ondrej Mosnacek
Software Engineer, Platform Security - SELinux kernel
Red Hat, Inc.

Re: 3.1 release notes draft

[Petr Lautrbach]

[-- Attachment #1: Type: text/plain, Size: 8145 bytes --]

On Thu, Jul 09, 2020 at 09:32:37AM -0400, Stephen Smalley wrote:
> On Thu, Jul 9, 2020 at 5:46 AM Petr Lautrbach <plautrba@redhat.com> wrote:
> >
> >
> > I'd like to release 3.1 today/tommorow to open the development of other
> > performance related improvemenets which which postponed. This is release notes
> > draft which is based on RELEASE-20200518.txt and RELEASE-20200619.txt:
> >
> > RELEASE 202007XX (3.1)
> >
> > User-visible changes:
> >
> > * selinux/flask.h and selinux/av_permissions.h were removed
> 
> Also sepol/policydb/flask.h although hopefully there were no external
> users of it.

Added

> > * `security_compute_user()` was deprecated - usage of /sys/fs/selinux/user { security:compute_user } might be revisited
> 
> Not sure what the last part "might be revisited" means; we have
> removed all uses of it internal to libselinux and deprecated the
> interface, with the intent of someday dropping it altogether and
> removing the kernel interface.

I've dropped " - usage of ... " part completely to make it simple


> One other user-visible change is commit
> 8677ce5e8f592950ae6f14cea1b68a20ddc1ac25 ("libsepol,checkpolicy:
> support omitting unused initial sid contexts") which allows policies
> to start omitting unused initial SID contexts going forward, as per
> its description and
> https://github.com/SELinuxProject/selinux-kernel/issues/12.
> 

Added

On Thu, Jul 09, 2020 at 05:23:13PM +0200, Ondrej Mosnacek wrote:
> Hi,
> 
> a couple nits below...
> 
> On Thu, Jul 9, 2020 at 11:45 AM Petr Lautrbach <plautrba@redhat.com> wrote:
> [...]
> >
> > * Support for new polcap genfs_seclabel_symlinks
> 
> s/polcap/policy capability/ ?

Changed

> >
> > * New `setfiles -E` option - treat conflicting specifications as errors, such
> > as where two hardlinks for the same inode have different contexts.
> >
> > * `restorecond_user.service` - new systemd user service which runs `restorecond -u`
> >
> > * `setsebool -V` reports errors from commit phase
> >
> > * Improved man pages
> >
> > * `semanage` uses ipaddress Python module instead of IPy
> >
> > * matchpathcon related interfaces are deprecated
> >
> > * selinuxfs is mounted with noexec and nosuid
> >
> > * Improved README which was renamed to README.md and converted to markdown.
> 
> This is more of a developer/packager/builder visible change rather
> than user visible IMHO. Maybe move it to a "Development-related
> changes" section?
> 
> >
> > * `setup.py` builds can be customized using PYTHON_SETUP_ARGS, e.g. to for
> >   Debian Python layout use: `make PYTHON_SETUP_ARGS=--install-layout=deb ...`
> 
> Ditto. Maybe the "Packaging-relevant changes" would fit better for this one?
> 
> >
> > * the dso wrappers for internal calls were removed and it is now strongly recommended to CFLAGS with
> >   `-fno-semantic-interposition`
> >
> > * `security_compute_user()` was deprecated - usage of /sys/fs/selinux/user { security:compute_user } might be revisited
> >
> > * checkpolicy treats invalid characters as an error - it might break (but intentional) rare use cases
> 
> I'd reword this to "might break rare use cases (intentionally)".
> 
> >
> > * New `restorecon -x` option - prevent `restorecon` from crossing file system
> >   boundaries.
> 
> "New `restorecon -x` option, which prevents it from crossing file
> system boundaries"?
> 
> >
> > * Handle `semanage module` in semanage bash completion
> >
> > * Added section about CFLAGS to README.md, see Packaging-relevant changes
> 
> Also mainly devel/packager-related.
> 
> >
> > * Improved man pages
> 
> This one is already listed further above .
> 
> >
> > * Add Travis CI job to run SELinux kernel testsuite on latest Fedora cloud image
> 
> Another purely development-related change.
> 
> >
> > * `sepolgen-ifgen` parses a gen_tunable statement as bool
> >
> > * `semanage` handles getprotobyname() failure case on Debian where /etc/protocols does not contain an entry for "ipv4"
> >
> > Packaging-relevant changes:
> [...]
> 

I've applied all your suggestions. The updated version is bellow.

Thanks for the feedback!


RELEASE 202007XX (3.1)
======================

User-visible changes
--------------------

* selinux/flask.h, selinux/av_permissions.h and sepol/policydb/flask.h were removed

  The flask.h and av_permissions.h header files were deprecated and
  all selinux userspace references to them were removed in
  commit 76913d8adb61b5 ("Deprecate use of flask.h and av_permissions.h.")
  back in 2014 and included in the 20150202 / 2.4 release.
  All userspace object managers should have been updated
  to use the dynamic class/perm mapping support since that time.
  Remove these headers finally to ensure that no users remain and
  that no future uses are ever introduced.

  Use string_to_security_class(3) and string_to_av_perm(3) to map the class and
  permission names to their policy values, or selinux_set_mapping(3) to create a
  mapping from class and permission index values used by the application to the
  policy values.

* Removed restrictions in libsepol and checkpolicy that required all declared
  initial SIDs to be assigned a context.

* Support for new policy capability genfs_seclabel_symlinks

* New `setfiles -E` option - treat conflicting specifications as errors, such
as where two hardlinks for the same inode have different contexts.

* `restorecond_user.service` - new systemd user service which runs `restorecond -u`

* `setsebool -V` reports errors from commit phase

* Improved man pages

* `semanage` uses ipaddress Python module instead of IPy

* matchpathcon related interfaces are deprecated

* selinuxfs is mounted with noexec and nosuid

* the dso wrappers for internal calls were removed and it is now strongly recommended to CFLAGS with
  `-fno-semantic-interposition`

* `security_compute_user()` was deprecated

* checkpolicy treats invalid characters as an error - might break rare use cases (intentionally)

* New `restorecon -x` option which prevents it from crossing file system boundaries.

* Handle `semanage module` in semanage bash completion

* `sepolgen-ifgen` parses a gen_tunable statement as bool

* `semanage` handles getprotobyname() failure case on Debian where /etc/protocols does not contain an entry for "ipv4"


Packaging-relevant changes
--------------------------

* Setting CFLAGS during the make process will cause the omission of many defaults. While the project strives
  to provide a reasonable set of default flags, custom CFLAGS could break the build, or have other undesired
  changes on the build output. Thus, be very careful when setting CFLAGS. CFLAGS that are encouraged to be
  set when overriding are:

  - -fno-semantic-interposition for gcc or compilers that do not do this. clang does this by default. clang-10 and up
    will support passing this flag, but ignore it. Previous clang versions fail.

* `setup.py` builds can be customized using PYTHON_SETUP_ARGS, e.g. to for
  Debian Python layout use: `make PYTHON_SETUP_ARGS=--install-layout=deb ...`


Development-relevant changes
----------------------------

* Improved README which was renamed to README.md and converted to markdown.

* Added Travis CI job to run SELinux kernel testsuite on latest Fedora cloud image


Issues fixed
------------

* https://github.com/SELinuxProject/selinux/issues/248
* https://github.com/SELinuxProject/selinux/issues/239
* https://github.com/SELinuxProject/selinux/issues/237
* https://github.com/SELinuxProject/selinux/issues/225
* https://github.com/SELinuxProject/selinux/issues/217
* https://github.com/SELinuxProject/selinux/issues/208
* https://github.com/SELinuxProject/selinux/issues/204
* https://github.com/SELinuxProject/selinux/issues/187
* https://github.com/SELinuxProject/selinux/issues/179
* https://github.com/SELinuxProject/selinux/issues/164
* https://github.com/SELinuxProject/selinux/issues/70
* https://github.com/SELinuxProject/selinux/issues/28



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]