summaryrefslogtreecommitdiff
path: root/src/libostree/ostree-sepolicy.h
Commit message (Collapse)AuthorAgeFilesLines
* Update FSF license notices to use URL instead of addressJoseph Marrero2021-12-071-3/+1
|
* repo: Add an API to init `OstreeSePolicy` from commit directlyColin Walters2021-09-301-0/+5
| | | | | | | | | | This is part of `OstreeCommitModifier`, but I'm not using that in some of the ostree-ext Rust code. It just makes more sense as a direct policy API, where it should have been in the first place. There's already support for setting a policy object on a commit modifier, so that's all the old API needs to do now.
* Add SPDX-License-Identifier to source filesMarcus Folkesson2018-01-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | SPDX License List is a list of (common) open source licenses that can be referred to by a “short identifier”. It has several advantages compared to the common "license header texts" usually found in source files. Some of the advantages: * It is precise; there is no ambiguity due to variations in license header text * It is language neutral * It is easy to machine process * It is concise * It is simple and can be used without much cost in interpreted environments like java Script, etc. * An SPDX license identifier is immutable. * It provides simple guidance for developers who want to make sure the license for their code is respected See http://spdx.org for further reading. Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com> Closes: #1439 Approved by: cgwalters
* tree-wide: Remove Emacs modelinesColin Walters2017-09-211-2/+1
| | | | | | | | | We added a `.dir-locals.el` in commit: 9a77017d87b74c5e2895cdd64ad098018929403f There's no need to have it per-file, with that people might think to add other editors, which is the wrong direction. Closes: #1206 Approved by: jlebon
* sepolicy: Add ostree_sepolicy_new_at()Colin Walters2017-03-221-0/+6
| | | | | | | | | I'm porting other code away from `GFile`, and while we don't use this internally, it will let us do so at a later date. I'm averse to changing the code right now as we don't have good CI coverage of this. Closes: #746 Approved by: jlebon
* OstreeSePolicy: add ostree_sepolicy_get_csum()Jonathan Lebon2016-03-251-0/+3
| | | | | | | | | | This can be used as a fingerprint to determine whether two OstreeSePolicy objects are equivalent. Also add documentation for ostree_sepolicy_get_name(). Closes: #219 Approved by: cgwalters
* lib: Introduce versioned symbolsColin Walters2016-03-011-0/+8
| | | | | | | | | | | | | | | | | | | | As rpm-ostree evolves, it keeps driving API additions to libostree. This creates a relatively tight coupling. However, if delivering via e.g. RPM, unless one manually remembers to increment the `Requires:` in the spec file, it's possible for the two to become desynchronized. RPM handles versioned symbols and will ensure a dependency if the application starts using a newer version. To implement this, switch to `-fvisibility=hidden`, along with an annotation in the header, and finally add a `.sym` file. This matches what other projects like systemd and libvirt do. Although rather than attempting to retroactively version symbols, glom them all onto the current one.
* syntax-check: Remove empty lines at the end of fileGiuseppe Scrivano2015-02-021-1/+0
| | | | Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Explicitly label .origin files as configurationColin Walters2015-01-231-0/+9
| | | | | | | | | | | | subscription-manager has a daemon that runs in a confined domain, and it doesn't have permission to write usr_t, which is the default label of /ostree/deploy/$osname/deploy. A better long term fix is probably to move the origin file into the deployment root as /etc/ostree/origin.conf or so. In the meantime, let's ensure the .origin files are labeled as configuration.
* libostree: Split off SELinux OstreeSePolicy classColin Walters2014-02-191-0/+66
It's better if this is independent from the OstreeSysroot; for example, a policy is active in a given deployment root at once, not for a sysroot globally. We can also collect SELinux-related API in one place. Unfortunately at the moment there can be only one instance of this class per process.