Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package yast2-installation for openSUSE:Factory checked in at 2021-12-29 21:10:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/yast2-installation (Old) and /work/SRC/openSUSE:Factory/.yast2-installation.new.2520 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "yast2-installation" Wed Dec 29 21:10:39 2021 rev:487 rq:942823 version:4.4.31 Changes: -------- --- /work/SRC/openSUSE:Factory/yast2-installation/yast2-installation.changes 2021-12-18 20:30:08.442239034 +0100 +++ /work/SRC/openSUSE:Factory/.yast2-installation.new.2520/yast2-installation.changes 2021-12-29 21:10:41.706272623 +0100 @@ -1,0 +2,7 @@ +Mon Dec 27 07:22:50 UTC 2021 - Knut Alejandro Anderssen Gonz??lez <kanders...@suse.com> + +- Add support for selecting and configuring the desired Linux + Security Module during installation (jsc#SLE-22069) +- 4.4.31 + +------------------------------------------------------------------- Old: ---- yast2-installation-4.4.30.tar.bz2 New: ---- yast2-installation-4.4.31.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ yast2-installation.spec ++++++ --- /var/tmp/diff_new_pack.7K0rgF/_old 2021-12-29 21:10:42.182273014 +0100 +++ /var/tmp/diff_new_pack.7K0rgF/_new 2021-12-29 21:10:42.186273017 +0100 @@ -17,7 +17,7 @@ Name: yast2-installation -Version: 4.4.30 +Version: 4.4.31 Release: 0 Summary: YaST2 - Installation Parts License: GPL-2.0-only @@ -43,7 +43,7 @@ BuildRequires: yast2-packager >= 4.4.13 # for AbortException and handle direct abort BuildRequires: yast2-ruby-bindings >= 4.0.6 -# For selinux classes +# For LSM classes BuildRequires: yast2-security # using /usr/bin/udevadm BuildRequires: yast2-storage-ng >= 4.2.71 @@ -117,8 +117,8 @@ Conflicts: yast2-pkg-bindings < 2.17.25 # Registration#get_updates_list does not handle exceptions Conflicts: yast2-registration < 3.2.3 -# moved security_finish client -Conflicts: yast2-security < 4.3.11 +# Added support for selecting the desired LSM during installation +Conflicts: yast2-security < 4.4.2 # Top bar with logo Conflicts: yast2-ycp-ui-bindings < 3.1.7 Obsoletes: yast2-installation-devel-doc ++++++ yast2-installation-4.4.30.tar.bz2 -> yast2-installation-4.4.31.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/.rubocop.yml new/yast2-installation-4.4.31/.rubocop.yml --- old/yast2-installation-4.4.30/.rubocop.yml 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/.rubocop.yml 2021-12-27 18:18:06.000000000 +0100 @@ -2,6 +2,10 @@ inherit_from: /usr/share/YaST2/data/devtools/data/rubocop_yast_style.yml + +AllCops: + TargetRubyVersion: 2.3 + # Offense count: 153 Metrics/AbcSize: Max: 304 @@ -69,3 +73,6 @@ Exclude: # mocked Registration.is_registered? - test/lib/upgrade_repo_manager_test.rb + +Style/FrozenStringLiteralComment: + Enabled: false diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/package/yast2-installation.changes new/yast2-installation-4.4.31/package/yast2-installation.changes --- old/yast2-installation-4.4.30/package/yast2-installation.changes 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/package/yast2-installation.changes 2021-12-27 18:18:06.000000000 +0100 @@ -1,4 +1,11 @@ ------------------------------------------------------------------- +Mon Dec 27 07:22:50 UTC 2021 - Knut Alejandro Anderssen Gonz??lez <kanders...@suse.com> + +- Add support for selecting and configuring the desired Linux + Security Module during installation (jsc#SLE-22069) +- 4.4.31 + +------------------------------------------------------------------- Thu Dec 16 13:43:05 UTC 2021 - Ladislav Slez??k <lsle...@suse.cz> - Self-update now supports relative URLs (relurl://), it defines diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/package/yast2-installation.spec new/yast2-installation-4.4.31/package/yast2-installation.spec --- old/yast2-installation-4.4.30/package/yast2-installation.spec 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/package/yast2-installation.spec 2021-12-27 18:18:06.000000000 +0100 @@ -17,7 +17,7 @@ Name: yast2-installation -Version: 4.4.30 +Version: 4.4.31 Release: 0 Summary: YaST2 - Installation Parts License: GPL-2.0-only @@ -43,7 +43,7 @@ BuildRequires: yast2-packager >= 4.4.13 # for AbortException and handle direct abort BuildRequires: yast2-ruby-bindings >= 4.0.6 -# For selinux classes +# For LSM classes BuildRequires: yast2-security # using /usr/bin/udevadm BuildRequires: yast2-storage-ng >= 4.2.71 @@ -117,8 +117,8 @@ Conflicts: yast2-pkg-bindings < 2.17.25 # Registration#get_updates_list does not handle exceptions Conflicts: yast2-registration < 3.2.3 -# moved security_finish client -Conflicts: yast2-security < 4.3.11 +# Added support for selecting the desired LSM during installation +Conflicts: yast2-security < 4.4.2 # Top bar with logo Conflicts: yast2-ycp-ui-bindings < 3.1.7 Obsoletes: yast2-installation-devel-doc diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/clients/security_finish.rb new/yast2-installation-4.4.31/src/lib/installation/clients/security_finish.rb --- old/yast2-installation-4.4.30/src/lib/installation/clients/security_finish.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/clients/security_finish.rb 2021-12-27 18:18:06.000000000 +0100 @@ -84,8 +84,8 @@ "/usr/bin/chkstat --system --set") log.info("updating capabilities: #{res}") - # Write down selinux configuration - settings.selinux_config.save + # Write down the Linux Security Module configuration + settings.lsm_config.save true end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/clients/security_proposal.rb new/yast2-installation-4.4.31/src/lib/installation/clients/security_proposal.rb --- old/yast2-installation-4.4.30/src/lib/installation/clients/security_proposal.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/clients/security_proposal.rb 2021-12-27 18:18:06.000000000 +0100 @@ -133,7 +133,7 @@ def proposals # Filter proposals with content [cpu_mitigations_proposal, firewall_proposal, sshd_proposal, - ssh_port_proposal, vnc_fw_proposal, selinux_proposal, + ssh_port_proposal, vnc_fw_proposal, lsm_proposal, polkit_default_priv_proposal].compact end @@ -238,16 +238,35 @@ format(_("PolicyKit Default Privileges: %s"), human_value) end - def selinux_proposal - return nil unless @settings.selinux_config.configurable? + # Returns the text describing the Linux Security Module proposal or nil in case that there is + # no module selected explicitly. + # + # @return [String, nil] returns the description of the selected LSM or nil in case no module + # is selected explicitly + def lsm_proposal + return nil unless @settings.lsm_config.configurable? # add required patterns - Yast::PackagesProposal.SetResolvables("SELinux", :pattern, - @settings.selinux_config.needed_patterns) - - _( - "SELinux Default Mode is %s" - ) % @settings.selinux_config.mode.to_human_string + log.info("Setting LSM resolvables to : #{@settings.lsm_config.needed_patterns}") + Yast::PackagesProposal.SetResolvables("LSM", :pattern, @settings.lsm_config.needed_patterns) + selected = @settings.lsm_config.selected + case selected&.id + when :selinux + # TRANSLATORS: Proposal's text describing that the active Linux Security Major Module + # after the installation will be SELinux running in the selected mode which could be + # 'enforcing', 'permissive' or 'disabled' + format(_( + "Linux Security Module: Activate %{module} in '%{mode}' mode" + ), module: selected.label, mode: selected.mode.to_human_string) + when :apparmor + # TRANSLATORS: Proposal's text describing that the active Linux Security Major Module + # after the installation will be AppArmor + format(_("Linux Security Module: Activate %{module}"), module: selected.label) + when :none + # TRANSLATORS: Proposal's text describing that no Linux Security Major Module will be + # activated after the installation + _("Linux Security Module: No major module will be activated") + end end end end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/dialogs/security.rb new/yast2-installation-4.4.31/src/lib/installation/dialogs/security.rb --- old/yast2-installation-4.4.30/src/lib/installation/dialogs/security.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/dialogs/security.rb 2021-12-27 18:18:06.000000000 +0100 @@ -19,7 +19,7 @@ require "yast" require "cwm/dialog" -require "installation/widgets/selinux_mode" +require "installation/widgets/lsm" require "installation/widgets/polkit_default_priv" Yast.import "Hostname" @@ -47,7 +47,7 @@ left_col = [firewall_frame, polkit_frame] right_col = [cpu_frame] - right_col << selinux_frame if selinux_configurable? + right_col << lsm_frame if lsm_configurable? HBox( HStretch(), @@ -99,8 +99,8 @@ true end - def selinux_configurable? - @settings.selinux_config.configurable? + def lsm_configurable? + @settings.lsm_config.configurable? end def firewall_frame @@ -124,10 +124,10 @@ ) end - def selinux_frame + def lsm_frame frame( - _("SELinux"), - Widgets::SelinuxMode.new(@settings) + _("Linux Security Module"), + Widgets::LSM.new(@settings) ) end @@ -135,11 +135,12 @@ Left( Frame( label, - HSquash( - MarginBox( - 0.5, - 0.5, - widget + MarginBox( + 0.5, + 0.5, + HBox( + widget, + HStretch() ) ) ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/security_settings.rb new/yast2-installation-4.4.31/src/lib/installation/security_settings.rb --- old/yast2-installation-4.4.30/src/lib/installation/security_settings.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/security_settings.rb 2021-12-27 18:18:06.000000000 +0100 @@ -18,8 +18,8 @@ # find current contact information at www.suse.com. require "yast" -require "y2security/selinux" require "y2users" +require "y2security/lsm" module Installation # Class that stores the security proposal settings during installation. @@ -40,8 +40,6 @@ # [String, nil] Setting for policy kit default privileges # For more info see /etc/sysconfig/security#POLKIT_DEFAULT_PRIVS attr_accessor :polkit_default_privileges - # [Y2Security::Selinux] selinux configuration - attr_accessor :selinux_config # Constructor def initialize @@ -55,6 +53,7 @@ enable_sshd! if wanted_enable_sshd? open_ssh! if wanted_open_ssh? open_vnc! if wanted_open_vnc? + lsm_config.propose_default unless lsm_config.selected # FIXME: obtain from Y2Firewall::Firewalld, control file or allow to # chose a different one in the proposal @default_zone = "public" @@ -154,11 +153,9 @@ } end - # Returns a SELinux configuration handler - # - # @return [Y2Security::Selinux] the SELinux config handler - def selinux_config - @selinux_config ||= Y2Security::Selinux.new + # @return [Y2Security::LSM::Config] the LSM config handler + def lsm_config + Y2Security::LSM::Config.instance end private diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/widgets/lsm.rb new/yast2-installation-4.4.31/src/lib/installation/widgets/lsm.rb --- old/yast2-installation-4.4.30/src/lib/installation/widgets/lsm.rb 1970-01-01 01:00:00.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/widgets/lsm.rb 2021-12-27 18:18:06.000000000 +0100 @@ -0,0 +1,144 @@ +# ------------------------------------------------------------------------------ +# Copyright (c) 2021 SUSE LLC, All Rights Reserved. +# +# This program is free software; you can redistribute it and/or modify it under +# the terms of version 2 of the GNU General Public License as published by the +# Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS +# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. +# +# ------------------------------------------------------------------------------ + +require "yast" +require "cwm/custom_widget" +require "cwm/replace_point" +require "cwm/common_widgets" +require "installation/widgets/selinux_mode" +require "installation/security_settings" +require "y2security/lsm/config" + +Yast.import "HTML" + +module Installation + module Widgets + # This widget contents a selector for choosing between the supported Linux Security Major + # Modules during installation. + # + # @note the selinux module will show also a selector for choosing the SELinux mode to be used + # after the system is booted + class LSM < CWM::CustomWidget + attr_accessor :settings + + # Constructor + # + # @param settings [Installation::SecuritySettings] + def initialize(settings) + @settings = settings + self.handle_all_events = true + end + + # @see CWM::CustomWidget#init + def init + lsm_selector_widget.init + refresh + end + + # @see CWM::CustomWidget#contents + def contents + VBox( + lsm_selector_widget, + Left(replace_widget) + ) + end + + # It refresh the widget content dinamically when the selection of the LSM is modified + # + # @param event [Hash] a UI event + def handle(event) + return if event["ID"] != lsm_selector_widget.widget_id + + refresh + nil + end + + private + + def replace_widget + @replace_widget ||= CWM::ReplacePoint.new(id: "lsm_widget", widget: empty_lsm_widget) + end + + def empty_lsm_widget + @empty_lsm_widget ||= CWM::Empty.new("lsm_empty") + end + + def lsm_selector_widget + @lsm_selector_widget ||= LSMSelector.new(settings.lsm_config) + end + + def selinux_widget + @selinux_widget ||= SelinuxMode.new(settings.lsm_config.selinux) + end + + # When the selected LSM is SELinux it shows the widget for selecting the SELinux mode + def refresh + case lsm_selector_widget.value + when "selinux" then replace_widget.replace(selinux_widget) + else + replace_widget.replace(empty_lsm_widget) + end + end + end + + # This class is a ComboBox for selecting the desired Linux Security Module to be used after the + # instalaltion + class LSMSelector < CWM::ComboBox + attr_reader :settings + + # Constructor + # + # @param settings [Y2Security::LSM::Config] + def initialize(settings) + textdomain "installation" + + @settings = settings + end + + def init + self.value = settings.selected&.id.to_s + end + + def opt + [:notify, :hstretch] + end + + def label + # TRANSLATORS: Linux Security Module Selector label. + _("Selected Module") + end + + def items + available_modules.map { |m| [m.id.to_s, m.label] } + end + + def store + settings.select(value) + end + + def help + Yast::HTML.Para( + # TRANSLATORS: Linux Security Module Selector help. + _("Allows to choose between available Linux Security major modules like:") + + Yast::HTML.List(available_modules.map(&:label)) + ) + end + + private + + def available_modules + settings.selectable + end + end + end +end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/widgets/polkit_default_priv.rb new/yast2-installation-4.4.31/src/lib/installation/widgets/polkit_default_priv.rb --- old/yast2-installation-4.4.30/src/lib/installation/widgets/polkit_default_priv.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/widgets/polkit_default_priv.rb 2021-12-27 18:18:06.000000000 +0100 @@ -38,25 +38,26 @@ end def help - _( - "<p>SUSE ships with three sets of default privilege " \ - "settings. These are as follows:<br><ul>" \ - "<li>\"restrictive\": conservative settings that " \ - "require the root user password for a lot of actions" \ - " and disable certain actions completely for remote " \ - "users.</li>" \ - "<li>\"standard\": balanced settings that restrict " \ - "sensitive actions to require root authentication " \ - "but allow less dangerous operations for regular " \ - "logged in users.</li>" \ - "<li>\"easy\": settings that are focused on ease " \ - "of use. This sacrifices security to some degree " \ - "to allow a more seamless user experience without" \ - " interruptions in the workflow due to password " \ - "prompts.</li></ul><br>" \ - "The \"default\" is to keep value empty and it will be " \ - "assigned automatically.</p>" - ) + "<b>#{label}</b>\n" + + _( + "<p>SUSE ships with three sets of default privilege " \ + "settings. These are as follows:<br><ul>" \ + "<li>\"restrictive\": conservative settings that " \ + "require the root user password for a lot of actions" \ + " and disable certain actions completely for remote " \ + "users.</li>" \ + "<li>\"standard\": balanced settings that restrict " \ + "sensitive actions to require root authentication " \ + "but allow less dangerous operations for regular " \ + "logged in users.</li>" \ + "<li>\"easy\": settings that are focused on ease " \ + "of use. This sacrifices security to some degree " \ + "to allow a more seamless user experience without" \ + " interruptions in the workflow due to password " \ + "prompts.</li></ul><br>" \ + "The \"default\" is to keep value empty and it will be " \ + "assigned automatically.</p>" + ) end def init diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/src/lib/installation/widgets/selinux_mode.rb new/yast2-installation-4.4.31/src/lib/installation/widgets/selinux_mode.rb --- old/yast2-installation-4.4.30/src/lib/installation/widgets/selinux_mode.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/src/lib/installation/widgets/selinux_mode.rb 2021-12-27 18:18:06.000000000 +0100 @@ -36,15 +36,16 @@ end def items - @settings.selinux_config.modes.map { |m| [m.id.to_s, m.to_human_string] } + @settings.modes.map { |m| [m.id.to_s, m.to_human_string] } end def init - self.value = @settings.selinux_config.mode.id.to_s + self.value = @settings.mode.id.to_s + disable unless @settings.configurable? end def store - @settings.selinux_config.mode = value.to_sym + @settings.mode = value.to_sym end def help diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/test/lib/clients/security_finish_test.rb new/yast2-installation-4.4.31/test/lib/clients/security_finish_test.rb --- old/yast2-installation-4.4.30/test/lib/clients/security_finish_test.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/test/lib/clients/security_finish_test.rb 2021-12-27 18:18:06.000000000 +0100 @@ -112,8 +112,8 @@ expect(Yast::SCR).to_not receive(:Write).with(path(".sysconfig.security.POLKIT_DEFAULT_PRIVS"), anything) end - it "skips writting selinux" do - expect(proposal_settings.selinux_config).to_not receive(:save) + it "skips writting LSM config" do + expect(proposal_settings.lsm_config).to_not receive(:save) subject.write end @@ -139,8 +139,8 @@ end end - it "saves selinux configuration" do - expect(proposal_settings.selinux_config).to receive(:save) + it "saves LSM configuration" do + expect(proposal_settings.lsm_config).to receive(:save) subject.write end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/test/lib/clients/security_proposal_test.rb new/yast2-installation-4.4.31/test/lib/clients/security_proposal_test.rb --- old/yast2-installation-4.4.30/test/lib/clients/security_proposal_test.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/test/lib/clients/security_proposal_test.rb 2021-12-27 18:18:06.000000000 +0100 @@ -106,7 +106,7 @@ before do allow(proposal_settings).to receive("enable_firewall").and_return(firewall_enabled) - allow(proposal_settings.selinux_config).to receive(:configurable?) + allow(proposal_settings.lsm_config).to receive(:configurable?) .and_return(false) end @@ -136,15 +136,15 @@ end end - context "when selinux is configurable" do - it "contains in proposal selinux configuration" do - allow(proposal_settings.selinux_config).to receive(:configurable?) + context "when LSM is configurable" do + it "contains the LSM configuration" do + allow(proposal_settings.lsm_config).to receive(:configurable?) .and_return(true) allow(Yast::Bootloader).to receive(:kernel_param).and_return(:missing) proposal = client.make_proposal({}) - expect(proposal["preformatted_proposal"]).to include("SELinux Default Mode") + expect(proposal["preformatted_proposal"]).to include("Linux Security Module:") end end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-installation-4.4.30/test/lib/widgets/selinux_mode_test.rb new/yast2-installation-4.4.31/test/lib/widgets/selinux_mode_test.rb --- old/yast2-installation-4.4.30/test/lib/widgets/selinux_mode_test.rb 2021-12-16 15:39:35.000000000 +0100 +++ new/yast2-installation-4.4.31/test/lib/widgets/selinux_mode_test.rb 2021-12-27 18:18:06.000000000 +0100 @@ -2,10 +2,12 @@ require_relative "../../test_helper" require "installation/widgets/selinux_mode" +require "y2security/lsm/selinux" require "cwm/rspec" describe Installation::Widgets::SelinuxMode do - subject { described_class.new(Installation::SecuritySettings.create_instance) } + subject { described_class.new(selinux_config) } + let(:selinux_config) { Y2Security::LSM::Selinux.new } include_examples "CWM::ComboBox" end