SELinuxProject / setools

SELinux Policy Analysis Tools
https://github.com/SELinuxProject/setools/wiki
Other
160 stars 65 forks source link

[setools 4.5.0] networkx is not optional anymore for sesearch and seinfo #125

Closed ca-hu closed 5 months ago

ca-hu commented 5 months ago

In setools 4.4.0, the networkx dependency was made only necessary for sedta and seinfoflow (see here and here)

The 5.6.0 update contains a refactoring, which makes the networkx dependency necessary again for other commands, such as sesearch and seinfo. This leads to issues when packaging for distributions that do not provide networkx and want to use setools in a minimal fashion.

I think it is because of this commit, which does not check if networkx exists: https://github.com/SELinuxProject/setools/commit/9a5ab901b1bb0cffad5ecf7895400dfc31270774

Reproduce:

  1. Remove networkx
  2. Build
  3. Run sesearch or seinfo command

Result:

$ sesearch -A -s bin_t
Traceback (most recent call last):
  File "/usr/bin/sesearch", line 7, in <module>
    import setools
  File "/usr/lib64/python3.11/site-packages/setools/__init__.py", line 80, in <module>
    from .infoflow import *
  File "/usr/lib64/python3.11/site-packages/setools/infoflow.py", line 33, in <module>
    class InfoFlowAnalysis(DirectedGraphAnalysis):
  File "/usr/lib64/python3.11/site-packages/setools/infoflow.py", line 210, in InfoFlowAnalysis
    def graphical_results(self) -> nx.DiGraph:
                                   ^^
NameError: name 'nx' is not defined

Expected Result:

$ sesearch -A -s bin_t
allow bin_t bin_t:dir { getattr open search };
allow bin_t bin_t:filesystem associate;
...

Solution

Maybe it could be checked in the setools/__init__.py if networkx is installed, and in case it is not, the sedta and seinfoflow could just not be imported.

Or can also be checked in the infoflow.py and sedta.py files every time it is used

pebenito commented 5 months ago

Please try this alternative fix: #128