|
 |
c9ef5a0 |
diff --git libselinux-2.4/Makefile libselinux-2.4/Makefile
|
|
 |
13a8a0f |
index 6142b60..bdf9de8 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/Makefile
|
|
|
c9ef5a0 |
+++ libselinux-2.4/Makefile
|
|
|
99813aa |
@@ -1,4 +1,4 @@
|
|
|
99813aa |
-SUBDIRS = src include utils man
|
|
|
99813aa |
+SUBDIRS = src include utils man golang
|
|
|
99813aa |
|
|
|
99813aa |
DISABLE_AVC ?= n
|
|
|
99813aa |
DISABLE_SETRANS ?= n
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/golang/Makefile libselinux-2.4/golang/Makefile
|
|
|
99813aa |
new file mode 100644
|
|
|
2492943 |
index 0000000..b75677b
|
|
|
99813aa |
--- /dev/null
|
|
|
c9ef5a0 |
+++ libselinux-2.4/golang/Makefile
|
|
|
2492943 |
@@ -0,0 +1,22 @@
|
|
|
99813aa |
+# Installation directories.
|
|
|
99813aa |
+PREFIX ?= $(DESTDIR)/usr
|
|
|
ee8c867 |
+LIBDIR ?= $(DESTDIR)/usr/lib
|
|
|
ee8c867 |
+GODIR ?= $(LIBDIR)/golang/src/pkg/github.com/selinux
|
|
|
99813aa |
+all:
|
|
|
99813aa |
+
|
|
|
99813aa |
+install:
|
|
|
99813aa |
+ [ -d $(GODIR) ] || mkdir -p $(GODIR)
|
|
|
99813aa |
+ install -m 644 selinux.go $(GODIR)
|
|
|
99813aa |
+
|
|
|
99813aa |
+test:
|
|
|
2492943 |
+ @mkdir selinux
|
|
|
2492943 |
+ @cp selinux.go selinux
|
|
|
2492943 |
+ GOPATH=$(pwd) go run test.go
|
|
|
2492943 |
+ @rm -rf selinux
|
|
|
99813aa |
+
|
|
|
99813aa |
+clean:
|
|
|
2492943 |
+ @rm -f *~
|
|
|
2492943 |
+ @rm -rf selinux
|
|
|
99813aa |
+indent:
|
|
|
99813aa |
+
|
|
|
99813aa |
+relabel:
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/golang/selinux.go libselinux-2.4/golang/selinux.go
|
|
|
99813aa |
new file mode 100644
|
|
|
820aece |
index 0000000..34bf6bb
|
|
|
99813aa |
--- /dev/null
|
|
|
c9ef5a0 |
+++ libselinux-2.4/golang/selinux.go
|
|
|
820aece |
@@ -0,0 +1,412 @@
|
|
|
99813aa |
+package selinux
|
|
|
99813aa |
+
|
|
|
99813aa |
+/*
|
|
|
99813aa |
+ The selinux package is a go bindings to libselinux required to add selinux
|
|
|
99813aa |
+ support to docker.
|
|
|
99813aa |
+
|
|
|
99813aa |
+ Author Dan Walsh <dwalsh@redhat.com>
|
|
|
99813aa |
+
|
|
|
99813aa |
+ Used some ideas/code from the go-ini packages https://github.com/vaughan0
|
|
|
99813aa |
+ By Vaughan Newton
|
|
|
99813aa |
+*/
|
|
|
99813aa |
+
|
|
|
99813aa |
+// #cgo pkg-config: libselinux
|
|
|
99813aa |
+// #include <selinux/selinux.h>
|
|
|
99813aa |
+// #include <stdlib.h>
|
|
|
99813aa |
+import "C"
|
|
|
99813aa |
+import (
|
|
|
820aece |
+ "bufio"
|
|
|
99813aa |
+ "crypto/rand"
|
|
|
820aece |
+ "encoding/binary"
|
|
|
99813aa |
+ "fmt"
|
|
|
99813aa |
+ "io"
|
|
|
99813aa |
+ "os"
|
|
|
820aece |
+ "path"
|
|
|
820aece |
+ "path/filepath"
|
|
|
820aece |
+ "regexp"
|
|
|
99813aa |
+ "strings"
|
|
|
820aece |
+ "unsafe"
|
|
|
99813aa |
+)
|
|
|
99813aa |
+
|
|
|
99813aa |
+var (
|
|
|
820aece |
+ assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`)
|
|
|
820aece |
+ mcsList = make(map[string]bool)
|
|
|
99813aa |
+)
|
|
|
99813aa |
+
|
|
|
820aece |
+func Matchpathcon(path string, mode os.FileMode) (string, error) {
|
|
|
99813aa |
+ var con C.security_context_t
|
|
|
99813aa |
+ var scon string
|
|
|
820aece |
+ rc, err := C.matchpathcon(C.CString(path), C.mode_t(mode), &con)
|
|
|
99813aa |
+ if rc == 0 {
|
|
|
99813aa |
+ scon = C.GoString(con)
|
|
|
99813aa |
+ C.free(unsafe.Pointer(con))
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ return scon, err
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func Setfilecon(path, scon string) (int, error) {
|
|
|
820aece |
+ rc, err := C.lsetfilecon(C.CString(path), C.CString(scon))
|
|
|
99813aa |
+ return int(rc), err
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
2492943 |
+func Getfilecon(path string) (string, error) {
|
|
|
2492943 |
+ var scon C.security_context_t
|
|
|
2492943 |
+ var fcon string
|
|
|
820aece |
+ rc, err := C.lgetfilecon(C.CString(path), &scon)
|
|
|
820aece |
+ if rc >= 0 {
|
|
|
820aece |
+ fcon = C.GoString(scon)
|
|
|
2492943 |
+ err = nil
|
|
|
2492943 |
+ }
|
|
|
2492943 |
+ return fcon, err
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
2492943 |
+func Setfscreatecon(scon string) (int, error) {
|
|
|
2492943 |
+ var (
|
|
|
820aece |
+ rc C.int
|
|
|
2492943 |
+ err error
|
|
|
2492943 |
+ )
|
|
|
820aece |
+ if scon != "" {
|
|
|
2492943 |
+ rc, err = C.setfscreatecon(C.CString(scon))
|
|
|
2492943 |
+ } else {
|
|
|
2492943 |
+ rc, err = C.setfscreatecon(nil)
|
|
|
2492943 |
+ }
|
|
|
2492943 |
+ return int(rc), err
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
2492943 |
+func Getfscreatecon() (string, error) {
|
|
|
2492943 |
+ var scon C.security_context_t
|
|
|
2492943 |
+ var fcon string
|
|
|
820aece |
+ rc, err := C.getfscreatecon(&scon)
|
|
|
820aece |
+ if rc >= 0 {
|
|
|
820aece |
+ fcon = C.GoString(scon)
|
|
|
2492943 |
+ err = nil
|
|
|
2492943 |
+ C.freecon(scon)
|
|
|
2492943 |
+ }
|
|
|
2492943 |
+ return fcon, err
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
820aece |
+func Getcon() string {
|
|
|
2492943 |
+ var pcon C.security_context_t
|
|
|
2492943 |
+ C.getcon(&pcon)
|
|
|
2492943 |
+ scon := C.GoString(pcon)
|
|
|
2492943 |
+ C.freecon(pcon)
|
|
|
2492943 |
+ return scon
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
2492943 |
+func Getpidcon(pid int) (string, error) {
|
|
|
2492943 |
+ var pcon C.security_context_t
|
|
|
2492943 |
+ var scon string
|
|
|
2492943 |
+ rc, err := C.getpidcon(C.pid_t(pid), &pcon)
|
|
|
820aece |
+ if rc >= 0 {
|
|
|
2492943 |
+ scon = C.GoString(pcon)
|
|
|
2492943 |
+ C.freecon(pcon)
|
|
|
2492943 |
+ err = nil
|
|
|
2492943 |
+ }
|
|
|
2492943 |
+ return scon, err
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
2492943 |
+func Getpeercon(socket int) (string, error) {
|
|
|
2492943 |
+ var pcon C.security_context_t
|
|
|
2492943 |
+ var scon string
|
|
|
2492943 |
+ rc, err := C.getpeercon(C.int(socket), &pcon)
|
|
|
820aece |
+ if rc >= 0 {
|
|
|
2492943 |
+ scon = C.GoString(pcon)
|
|
|
2492943 |
+ C.freecon(pcon)
|
|
|
2492943 |
+ err = nil
|
|
|
2492943 |
+ }
|
|
|
2492943 |
+ return scon, err
|
|
|
2492943 |
+}
|
|
|
2492943 |
+
|
|
|
820aece |
+func Setexeccon(scon string) error {
|
|
|
99813aa |
+ var val *C.char
|
|
|
820aece |
+ if !SelinuxEnabled() {
|
|
|
820aece |
+ return nil
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ if scon != "" {
|
|
|
99813aa |
+ val = C.CString(scon)
|
|
|
99813aa |
+ } else {
|
|
|
99813aa |
+ val = nil
|
|
|
99813aa |
+ }
|
|
|
820aece |
+ _, err := C.setexeccon(val)
|
|
|
820aece |
+ return err
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
99813aa |
+type Context struct {
|
|
|
99813aa |
+ con []string
|
|
|
99813aa |
+}
|
|
|
820aece |
+
|
|
|
820aece |
+func (c *Context) SetUser(user string) {
|
|
|
820aece |
+ c.con[0] = user
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) GetUser() string {
|
|
|
99813aa |
+ return c.con[0]
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) SetRole(role string) {
|
|
|
820aece |
+ c.con[1] = role
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) GetRole() string {
|
|
|
99813aa |
+ return c.con[1]
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) SetType(setype string) {
|
|
|
820aece |
+ c.con[2] = setype
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) GetType() string {
|
|
|
99813aa |
+ return c.con[2]
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) SetLevel(mls string) {
|
|
|
820aece |
+ c.con[3] = mls
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) GetLevel() string {
|
|
|
99813aa |
+ return c.con[3]
|
|
|
99813aa |
+}
|
|
|
820aece |
+func (c *Context) Get() string {
|
|
|
820aece |
+ return strings.Join(c.con, ":")
|
|
|
99813aa |
+}
|
|
|
99813aa |
+func (c *Context) Set(scon string) {
|
|
|
820aece |
+ c.con = strings.SplitN(scon, ":", 4)
|
|
|
99813aa |
+}
|
|
|
820aece |
+func NewContext(scon string) Context {
|
|
|
99813aa |
+ var con Context
|
|
|
99813aa |
+ con.Set(scon)
|
|
|
99813aa |
+ return con
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func SelinuxEnabled() bool {
|
|
|
99813aa |
+ b := C.is_selinux_enabled()
|
|
|
99813aa |
+ if b > 0 {
|
|
|
820aece |
+ return true
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ return false
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
99813aa |
+const (
|
|
|
820aece |
+ Enforcing = 1
|
|
|
99813aa |
+ Permissive = 0
|
|
|
820aece |
+ Disabled = -1
|
|
|
99813aa |
+)
|
|
|
99813aa |
+
|
|
|
820aece |
+func SelinuxGetEnforce() int {
|
|
|
99813aa |
+ return int(C.security_getenforce())
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func SelinuxGetEnforceMode() int {
|
|
|
99813aa |
+ var enforce C.int
|
|
|
99813aa |
+ C.selinux_getenforcemode(&enforce)
|
|
|
99813aa |
+ return int(enforce)
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func mcsAdd(mcs string) {
|
|
|
820aece |
+ mcsList[mcs] = true
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func mcsDelete(mcs string) {
|
|
|
820aece |
+ mcsList[mcs] = false
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func mcsExists(mcs string) bool {
|
|
|
820aece |
+ return mcsList[mcs]
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func IntToMcs(id int, catRange uint32) string {
|
|
|
820aece |
+ if (id < 1) || (id > 523776) {
|
|
|
820aece |
+ return ""
|
|
|
820aece |
+ }
|
|
|
ee8c867 |
+
|
|
|
820aece |
+ SETSIZE := int(catRange)
|
|
|
820aece |
+ TIER := SETSIZE
|
|
|
ee8c867 |
+
|
|
|
820aece |
+ ORD := id
|
|
|
820aece |
+ for ORD > TIER {
|
|
|
820aece |
+ ORD = ORD - TIER
|
|
|
820aece |
+ TIER -= 1
|
|
|
ee8c867 |
+ }
|
|
|
820aece |
+ TIER = SETSIZE - TIER
|
|
|
820aece |
+ ORD = ORD + TIER
|
|
|
820aece |
+ return fmt.Sprintf("s0:c%d,c%d", TIER, ORD)
|
|
|
ee8c867 |
+}
|
|
|
ee8c867 |
+
|
|
|
820aece |
+func uniqMcs(catRange uint32) string {
|
|
|
99813aa |
+ var n uint32
|
|
|
820aece |
+ var c1, c2 uint32
|
|
|
99813aa |
+ var mcs string
|
|
|
820aece |
+ for {
|
|
|
99813aa |
+ binary.Read(rand.Reader, binary.LittleEndian, &n)
|
|
|
99813aa |
+ c1 = n % catRange
|
|
|
99813aa |
+ binary.Read(rand.Reader, binary.LittleEndian, &n)
|
|
|
99813aa |
+ c2 = n % catRange
|
|
|
99813aa |
+ if c1 == c2 {
|
|
|
99813aa |
+ continue
|
|
|
99813aa |
+ } else {
|
|
|
99813aa |
+ if c1 > c2 {
|
|
|
99813aa |
+ t := c1
|
|
|
99813aa |
+ c1 = c2
|
|
|
99813aa |
+ c2 = t
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)
|
|
|
820aece |
+ if mcsExists(mcs) {
|
|
|
99813aa |
+ continue
|
|
|
99813aa |
+ }
|
|
|
820aece |
+ mcsAdd(mcs)
|
|
|
99813aa |
+ break
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ return mcs
|
|
|
99813aa |
+}
|
|
|
820aece |
+func freeContext(processLabel string) {
|
|
|
99813aa |
+ var scon Context
|
|
|
820aece |
+ scon = NewContext(processLabel)
|
|
|
820aece |
+ mcsDelete(scon.GetLevel())
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func GetLxcContexts() (processLabel string, fileLabel string) {
|
|
|
99813aa |
+ var val, key string
|
|
|
99813aa |
+ var bufin *bufio.Reader
|
|
|
820aece |
+ if !SelinuxEnabled() {
|
|
|
99813aa |
+ return
|
|
|
99813aa |
+ }
|
|
|
820aece |
+ lxcPath := C.GoString(C.selinux_lxc_contexts_path())
|
|
|
820aece |
+ fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0"
|
|
|
820aece |
+ processLabel = "system_u:system_r:svirt_lxc_net_t:s0"
|
|
|
99813aa |
+
|
|
|
820aece |
+ in, err := os.Open(lxcPath)
|
|
|
99813aa |
+ if err != nil {
|
|
|
99813aa |
+ goto exit
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+
|
|
|
99813aa |
+ defer in.Close()
|
|
|
99813aa |
+ bufin = bufio.NewReader(in)
|
|
|
99813aa |
+
|
|
|
99813aa |
+ for done := false; !done; {
|
|
|
99813aa |
+ var line string
|
|
|
99813aa |
+ if line, err = bufin.ReadString('\n'); err != nil {
|
|
|
99813aa |
+ if err == io.EOF {
|
|
|
99813aa |
+ done = true
|
|
|
99813aa |
+ } else {
|
|
|
99813aa |
+ goto exit
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ line = strings.TrimSpace(line)
|
|
|
99813aa |
+ if len(line) == 0 {
|
|
|
99813aa |
+ // Skip blank lines
|
|
|
99813aa |
+ continue
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ if line[0] == ';' || line[0] == '#' {
|
|
|
99813aa |
+ // Skip comments
|
|
|
99813aa |
+ continue
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ if groups := assignRegex.FindStringSubmatch(line); groups != nil {
|
|
|
99813aa |
+ key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])
|
|
|
99813aa |
+ if key == "process" {
|
|
|
820aece |
+ processLabel = strings.Trim(val, "\"")
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ if key == "file" {
|
|
|
820aece |
+ fileLabel = strings.Trim(val, "\"")
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+exit:
|
|
|
99813aa |
+ var scon Context
|
|
|
820aece |
+ mcs := IntToMcs(os.Getpid(), 1024)
|
|
|
820aece |
+ scon = NewContext(processLabel)
|
|
|
820aece |
+ scon.SetLevel(mcs)
|
|
|
820aece |
+ processLabel = scon.Get()
|
|
|
820aece |
+ scon = NewContext(fileLabel)
|
|
|
820aece |
+ scon.SetLevel(mcs)
|
|
|
820aece |
+ fileLabel = scon.Get()
|
|
|
820aece |
+ return processLabel, fileLabel
|
|
|
820aece |
+}
|
|
|
820aece |
+
|
|
|
820aece |
+func CopyLevel(src, dest string) (string, error) {
|
|
|
820aece |
+ if !SelinuxEnabled() {
|
|
|
99813aa |
+ return "", nil
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ if src == "" {
|
|
|
99813aa |
+ return "", nil
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ rc, err := C.security_check_context(C.CString(src))
|
|
|
99813aa |
+ if rc != 0 {
|
|
|
99813aa |
+ return "", err
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+ rc, err = C.security_check_context(C.CString(dest))
|
|
|
99813aa |
+ if rc != 0 {
|
|
|
99813aa |
+ return "", err
|
|
|
99813aa |
+ }
|
|
|
820aece |
+ scon := NewContext(src)
|
|
|
820aece |
+ tcon := NewContext(dest)
|
|
|
820aece |
+ tcon.SetLevel(scon.GetLevel())
|
|
|
99813aa |
+ return tcon.Get(), nil
|
|
|
99813aa |
+}
|
|
|
99813aa |
+
|
|
|
820aece |
+func RestoreCon(fpath string, recurse bool) error {
|
|
|
820aece |
+ var flabel string
|
|
|
820aece |
+ var err error
|
|
|
820aece |
+ var fs os.FileInfo
|
|
|
820aece |
+
|
|
|
820aece |
+ if !SelinuxEnabled() {
|
|
|
820aece |
+ return nil
|
|
|
820aece |
+ }
|
|
|
820aece |
+
|
|
|
820aece |
+ if recurse {
|
|
|
820aece |
+ var paths []string
|
|
|
820aece |
+ var err error
|
|
|
820aece |
+
|
|
|
820aece |
+ if paths, err = filepath.Glob(path.Join(fpath, "**", "*")); err != nil {
|
|
|
820aece |
+ return fmt.Errorf("Unable to find directory %v: %v", fpath, err)
|
|
|
820aece |
+ }
|
|
|
820aece |
+
|
|
|
820aece |
+ for _, fpath := range paths {
|
|
|
820aece |
+ if err = RestoreCon(fpath, false); err != nil {
|
|
|
820aece |
+ return fmt.Errorf("Unable to restore selinux context for %v: %v", fpath, err)
|
|
|
820aece |
+ }
|
|
|
820aece |
+ }
|
|
|
820aece |
+ return nil
|
|
|
820aece |
+ }
|
|
|
820aece |
+ if fs, err = os.Stat(fpath); err != nil {
|
|
|
820aece |
+ return fmt.Errorf("Unable stat %v: %v", fpath, err)
|
|
|
820aece |
+ }
|
|
|
820aece |
+
|
|
|
820aece |
+ if flabel, err = Matchpathcon(fpath, fs.Mode()); flabel == "" {
|
|
|
820aece |
+ return fmt.Errorf("Unable to get context for %v: %v", fpath, err)
|
|
|
820aece |
+ }
|
|
|
820aece |
+
|
|
|
820aece |
+ if rc, err := Setfilecon(fpath, flabel); rc != 0 {
|
|
|
820aece |
+ return fmt.Errorf("Unable to set selinux context for %v: %v", fpath, err)
|
|
|
820aece |
+ }
|
|
|
820aece |
+
|
|
|
820aece |
+ return nil
|
|
|
820aece |
+}
|
|
|
820aece |
+
|
|
|
99813aa |
+func Test() {
|
|
|
820aece |
+ var plabel, flabel string
|
|
|
820aece |
+ if !SelinuxEnabled() {
|
|
|
99813aa |
+ return
|
|
|
99813aa |
+ }
|
|
|
99813aa |
+
|
|
|
820aece |
+ plabel, flabel = GetLxcContexts()
|
|
|
99813aa |
+ fmt.Println(plabel)
|
|
|
99813aa |
+ fmt.Println(flabel)
|
|
|
820aece |
+ freeContext(plabel)
|
|
|
820aece |
+ plabel, flabel = GetLxcContexts()
|
|
|
99813aa |
+ fmt.Println(plabel)
|
|
|
99813aa |
+ fmt.Println(flabel)
|
|
|
820aece |
+ freeContext(plabel)
|
|
|
820aece |
+ if SelinuxEnabled() {
|
|
|
99813aa |
+ fmt.Println("Enabled")
|
|
|
99813aa |
+ } else {
|
|
|
99813aa |
+ fmt.Println("Disabled")
|
|
|
99813aa |
+ }
|
|
|
820aece |
+ fmt.Println("getenforce ", SelinuxGetEnforce())
|
|
|
820aece |
+ fmt.Println("getenforcemode ", SelinuxGetEnforceMode())
|
|
|
820aece |
+ flabel, _ = Matchpathcon("/home/dwalsh/.emacs", 0)
|
|
|
99813aa |
+ fmt.Println(flabel)
|
|
|
ee8c867 |
+ pid := os.Getpid()
|
|
|
820aece |
+ fmt.Printf("PID:%d MCS:%s\n", pid, IntToMcs(pid, 1023))
|
|
|
2492943 |
+ fmt.Println(Getcon())
|
|
|
2492943 |
+ fmt.Println(Getfilecon("/etc/passwd"))
|
|
|
2492943 |
+ fmt.Println(Getpidcon(1))
|
|
|
2492943 |
+ Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0")
|
|
|
2492943 |
+ fmt.Println(Getfscreatecon())
|
|
|
2492943 |
+ Setfscreatecon("")
|
|
|
2492943 |
+ fmt.Println(Getfscreatecon())
|
|
|
2492943 |
+ fmt.Println(Getpidcon(1))
|
|
|
2492943 |
+}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/golang/test.go libselinux-2.4/golang/test.go
|
|
|
2492943 |
new file mode 100644
|
|
|
2492943 |
index 0000000..fed6de8
|
|
|
2492943 |
--- /dev/null
|
|
|
c9ef5a0 |
+++ libselinux-2.4/golang/test.go
|
|
|
2492943 |
@@ -0,0 +1,9 @@
|
|
|
2492943 |
+package main
|
|
|
2492943 |
+
|
|
|
2492943 |
+import (
|
|
|
2492943 |
+ "./selinux"
|
|
|
2492943 |
+)
|
|
|
2492943 |
+
|
|
|
2492943 |
+func main() {
|
|
|
2492943 |
+ selinux.Test()
|
|
|
99813aa |
+}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/include/selinux/selinux.h libselinux-2.4/include/selinux/selinux.h
|
|
 |
aa0f5b6 |
index d0eb5c6..4beb170 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/include/selinux/selinux.h
|
|
|
c9ef5a0 |
+++ libselinux-2.4/include/selinux/selinux.h
|
|
|
aa0f5b6 |
@@ -543,6 +543,7 @@ extern const char *selinux_virtual_image_context_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_lxc_contexts_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_x_context_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_sepgsql_context_path(void);
|
|
|
aa0f5b6 |
+extern const char *selinux_openssh_contexts_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_systemd_contexts_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_contexts_path(void);
|
|
|
aa0f5b6 |
extern const char *selinux_securetty_types_path(void);
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man3/getfscreatecon.3 libselinux-2.4/man/man3/getfscreatecon.3
|
|
|
13a8a0f |
index e348d3b..8cc4df5 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man3/getfscreatecon.3
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man3/getfscreatecon.3
|
|
|
2492943 |
@@ -49,6 +49,11 @@ Signal handlers that perform a
|
|
|
2492943 |
must take care to
|
|
|
2492943 |
save, reset, and restore the fscreate context to avoid unexpected behavior.
|
|
|
2492943 |
.
|
|
|
2492943 |
+
|
|
|
2492943 |
+.br
|
|
|
2492943 |
+.B Note:
|
|
|
2492943 |
+Contexts are thread specific.
|
|
|
2492943 |
+
|
|
|
2492943 |
.SH "RETURN VALUE"
|
|
|
2492943 |
On error \-1 is returned.
|
|
|
2492943 |
On success 0 is returned.
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man3/getkeycreatecon.3 libselinux-2.4/man/man3/getkeycreatecon.3
|
|
|
13a8a0f |
index 4d70f10..b51008d 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man3/getkeycreatecon.3
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man3/getkeycreatecon.3
|
|
|
2492943 |
@@ -48,6 +48,10 @@ Signal handlers that perform a
|
|
|
2492943 |
.BR setkeycreatecon ()
|
|
|
2492943 |
must take care to
|
|
|
2492943 |
save, reset, and restore the keycreate context to avoid unexpected behavior.
|
|
|
2492943 |
+
|
|
|
2492943 |
+.br
|
|
|
2492943 |
+.B Note:
|
|
|
2492943 |
+Contexts are thread specific.
|
|
|
2492943 |
.
|
|
|
2492943 |
.SH "RETURN VALUE"
|
|
|
2492943 |
On error \-1 is returned.
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man3/getsockcreatecon.3 libselinux-2.4/man/man3/getsockcreatecon.3
|
|
|
13a8a0f |
index 4dd8f30..26086d9 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man3/getsockcreatecon.3
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man3/getsockcreatecon.3
|
|
|
2492943 |
@@ -49,6 +49,11 @@ Signal handlers that perform a
|
|
|
2492943 |
must take care to
|
|
|
2492943 |
save, reset, and restore the sockcreate context to avoid unexpected behavior.
|
|
|
2492943 |
.
|
|
|
2492943 |
+
|
|
|
2492943 |
+.br
|
|
|
2492943 |
+.B Note:
|
|
|
2492943 |
+Contexts are thread specific.
|
|
|
2492943 |
+
|
|
|
2492943 |
.SH "RETURN VALUE"
|
|
|
2492943 |
On error \-1 is returned.
|
|
|
2492943 |
On success 0 is returned.
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man3/matchpathcon.3 libselinux-2.4/man/man3/matchpathcon.3
|
|
|
07d81e8 |
index 1bc7ba1..177f15d 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man3/matchpathcon.3
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man3/matchpathcon.3
|
|
|
07d81e8 |
@@ -7,7 +7,7 @@ matchpathcon, matchpathcon_index \- get the default SELinux security context for
|
|
|
07d81e8 |
.sp
|
|
|
07d81e8 |
.BI "int matchpathcon_init(const char *" path ");"
|
|
|
07d81e8 |
.sp
|
|
|
07d81e8 |
-.BI "int matchpathcon_init_prefix(const char *" path ", const char *" subset ");"
|
|
|
07d81e8 |
+.BI "int matchpathcon_init_prefix(const char *" path ", const char *" prefix ");"
|
|
|
07d81e8 |
.sp
|
|
|
07d81e8 |
.BI "int matchpathcon_fini(void);"
|
|
|
07d81e8 |
.sp
|
|
|
07d81e8 |
@@ -16,6 +16,24 @@ matchpathcon, matchpathcon_index \- get the default SELinux security context for
|
|
|
07d81e8 |
.BI "int matchpathcon_index(const char *" name ", mode_t " mode ", char **" con ");"
|
|
|
07d81e8 |
.
|
|
|
07d81e8 |
.SH "DESCRIPTION"
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
+This family of functions is deprecated. For new code, please use
|
|
|
07d81e8 |
+.BR selabel_open (3)
|
|
|
07d81e8 |
+with the
|
|
|
07d81e8 |
+.B SELABEL_CTX_FILE
|
|
|
07d81e8 |
+backend in place of
|
|
|
07d81e8 |
+.BR matchpathcon_init (),
|
|
|
07d81e8 |
+use
|
|
|
07d81e8 |
+.BR selabel_close (3)
|
|
|
07d81e8 |
+in place of
|
|
|
07d81e8 |
+.BR matchpathcon_fini (),
|
|
|
07d81e8 |
+and use
|
|
|
07d81e8 |
+.BR selabel_lookup (3)
|
|
|
07d81e8 |
+in place of
|
|
|
07d81e8 |
+.BR matchpathcon ().
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
+The remaining description below is for the legacy interface.
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
.BR matchpathcon_init ()
|
|
|
07d81e8 |
loads the file contexts configuration specified by
|
|
|
07d81e8 |
.I path
|
|
|
07d81e8 |
@@ -41,9 +59,16 @@ customizations.
|
|
|
07d81e8 |
.BR matchpathcon_init_prefix ()
|
|
|
07d81e8 |
is the same as
|
|
|
07d81e8 |
.BR matchpathcon_init ()
|
|
|
07d81e8 |
-but only loads entries with regular expressions that have stems prefixed
|
|
|
07d81e8 |
-by
|
|
|
07d81e8 |
-.I \%prefix.
|
|
|
07d81e8 |
+but only loads entries with regular expressions whose first pathname
|
|
|
07d81e8 |
+component is a prefix of
|
|
|
07d81e8 |
+.I \%prefix
|
|
|
07d81e8 |
+, e.g. pass "/dev" if you only intend to call
|
|
|
07d81e8 |
+.BR matchpathcon ()
|
|
|
07d81e8 |
+with pathnames beginning with /dev.
|
|
|
07d81e8 |
+However, this optimization is no longer necessary due to the use of
|
|
|
07d81e8 |
+.I file_contexts.bin
|
|
|
07d81e8 |
+files with precompiled regular expressions, so use of this interface
|
|
|
07d81e8 |
+is deprecated.
|
|
|
07d81e8 |
|
|
|
07d81e8 |
.BR matchpathcon_fini ()
|
|
|
07d81e8 |
frees the memory allocated by a prior call to
|
|
|
07d81e8 |
@@ -54,7 +79,17 @@ calls, or to free memory when finished using
|
|
|
07d81e8 |
.BR matchpathcon ().
|
|
|
07d81e8 |
|
|
|
07d81e8 |
.BR matchpathcon ()
|
|
|
07d81e8 |
-matches the specified pathname and mode against the file contexts
|
|
|
07d81e8 |
+matches the specified
|
|
|
07d81e8 |
+.I pathname,
|
|
|
07d81e8 |
+after transformation via
|
|
|
07d81e8 |
+.BR realpath (3)
|
|
|
07d81e8 |
+excepting any final symbolic link component if S_IFLNK was
|
|
|
07d81e8 |
+specified as the
|
|
|
07d81e8 |
+.I mode,
|
|
|
07d81e8 |
+and
|
|
|
07d81e8 |
+.I mode
|
|
|
07d81e8 |
+against the
|
|
|
07d81e8 |
+.I file contexts
|
|
|
07d81e8 |
configuration and sets the security context
|
|
|
07d81e8 |
.I con
|
|
|
07d81e8 |
to refer to the
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man5/selabel_file.5 libselinux-2.4/man/man5/selabel_file.5
|
|
|
07d81e8 |
index 79eca95..e738824 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man5/selabel_file.5
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man5/selabel_file.5
|
|
|
07d81e8 |
@@ -55,7 +55,9 @@ A non-null value for this option specifies a path to a file that will be opened
|
|
|
07d81e8 |
A non-null value for this option indicates that any local customizations to the file contexts mapping should be ignored.
|
|
|
07d81e8 |
.TP
|
|
|
07d81e8 |
.B SELABEL_OPT_SUBSET
|
|
|
07d81e8 |
-A non-null value for this option is interpreted as a path prefix, for example "/etc". Only file context specifications starting with the given prefix are loaded. This may increase lookup performance, however any attempt to look up a path not starting with the given prefix will fail.
|
|
|
07d81e8 |
+A non-null value for this option is interpreted as a path prefix, for example "/etc". Only file context specifications with starting with a first component that prefix matches the given prefix are loaded. This may increase lookup performance, however any attempt to look up a path not starting with the given prefix may fail. This optimization is no longer required due to the use of
|
|
|
07d81e8 |
+.I file_contexts.bin
|
|
|
07d81e8 |
+files and is deprecated.
|
|
|
07d81e8 |
.RE
|
|
|
07d81e8 |
.
|
|
|
07d81e8 |
.SH "FILES"
|
|
|
07d81e8 |
@@ -206,7 +208,7 @@ component with \fI/var/www\fR, therefore the path used is:
|
|
|
07d81e8 |
If contexts are to be validated, then the global option \fBSELABEL_OPT_VALIDATE\fR must be set before calling \fBselabel_open\fR(3). If this is not set, then it is possible for an invalid context to be returned.
|
|
|
07d81e8 |
.IP "2." 4
|
|
|
07d81e8 |
If the size of file contexts series of files contain many entries, then \fBselabel_open\fR(3) may have a delay as it reads in the files, and if
|
|
|
07d81e8 |
-requested validates the entries. If possible use the \fBSELABEL_OPT_SUBSET\fR option to reduce the number of entries processed.
|
|
|
07d81e8 |
+requested validates the entries.
|
|
|
07d81e8 |
.IP "3." 4
|
|
|
07d81e8 |
Depending on the version of SELinux it is possible that a \fIfile_contexts.template\fR file may also be present, however this is now deprecated.
|
|
|
07d81e8 |
.br
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/man/man8/selinux.8 libselinux-2.4/man/man8/selinux.8
|
|
|
c9ef5a0 |
index 9e3bdc4..fd20363 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/man/man8/selinux.8
|
|
|
c9ef5a0 |
+++ libselinux-2.4/man/man8/selinux.8
|
|
|
aa0f5b6 |
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
|
|
aa0f5b6 |
.BR sepolicy (8),
|
|
|
aa0f5b6 |
.BR system-config-selinux (8),
|
|
|
aa0f5b6 |
.BR togglesebool (8),
|
|
|
aa0f5b6 |
-.BR restorecon (8),
|
|
|
aa0f5b6 |
.BR fixfiles (8),
|
|
|
aa0f5b6 |
+.BR restorecon (8),
|
|
|
aa0f5b6 |
.BR setfiles (8),
|
|
|
aa0f5b6 |
.BR semanage (8),
|
|
|
aa0f5b6 |
-.BR sepolicy(8)
|
|
|
aa0f5b6 |
+.BR sepolicy(8),
|
|
|
aa0f5b6 |
+.BR seinfo(8),
|
|
|
aa0f5b6 |
+.BR sesearch(8)
|
|
|
aa0f5b6 |
|
|
|
aa0f5b6 |
Every confined service on the system has a man page in the following format:
|
|
|
aa0f5b6 |
.br
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/Makefile libselinux-2.4/src/Makefile
|
|
|
c9ef5a0 |
index 82cb6ed..ac25c1f 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/Makefile
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/Makefile
|
|
|
eb63890 |
@@ -59,7 +59,7 @@ CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissi
|
|
|
eb63890 |
-Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
|
|
|
eb63890 |
-Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
|
|
|
eb63890 |
-Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
|
|
|
eb63890 |
- -Wdisabled-optimization -Wbuiltin-macro-redefined -Wmudflap -Wpacked-bitfield-compat \
|
|
|
eb63890 |
+ -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
|
|
|
eb63890 |
-Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
|
|
|
eb63890 |
-Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
|
|
|
eb63890 |
-Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/avc.c libselinux-2.4/src/avc.c
|
|
|
eb63890 |
index 2bd7d13..b1ec57f 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/avc.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/avc.c
|
|
|
eb63890 |
@@ -288,7 +288,7 @@ void avc_av_stats(void)
|
|
|
eb63890 |
|
|
|
eb63890 |
avc_release_lock(avc_lock);
|
|
|
eb63890 |
|
|
|
eb63890 |
- avc_log(SELINUX_INFO, "%s: %d AV entries and %d/%d buckets used, "
|
|
|
eb63890 |
+ avc_log(SELINUX_INFO, "%s: %u AV entries and %d/%d buckets used, "
|
|
|
eb63890 |
"longest chain length %d\n", avc_prefix,
|
|
|
eb63890 |
avc_cache.active_nodes,
|
|
|
eb63890 |
slots_used, AVC_CACHE_SLOTS, max_chain_len);
|
|
|
eb63890 |
@@ -471,7 +471,7 @@ static int avc_insert(security_id_t ssid, security_id_t tsid,
|
|
|
eb63890 |
|
|
|
eb63890 |
if (ae->avd.seqno < avc_cache.latest_notif) {
|
|
|
eb63890 |
avc_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: seqno %d < latest_notif %d\n", avc_prefix,
|
|
|
eb63890 |
+ "%s: seqno %u < latest_notif %u\n", avc_prefix,
|
|
|
eb63890 |
ae->avd.seqno, avc_cache.latest_notif);
|
|
|
eb63890 |
errno = EAGAIN;
|
|
|
eb63890 |
rc = -1;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/avc_internal.c libselinux-2.4/src/avc_internal.c
|
|
|
eb63890 |
index f735e73..be94857 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/avc_internal.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/avc_internal.c
|
|
|
eb63890 |
@@ -125,14 +125,14 @@ static int avc_netlink_receive(char *buf, unsigned buflen, int blocking)
|
|
|
eb63890 |
|
|
|
eb63890 |
if (nladdrlen != sizeof nladdr) {
|
|
|
eb63890 |
avc_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: warning: netlink address truncated, len %d?\n",
|
|
|
eb63890 |
+ "%s: warning: netlink address truncated, len %u?\n",
|
|
|
eb63890 |
avc_prefix, nladdrlen);
|
|
|
eb63890 |
return -1;
|
|
|
eb63890 |
}
|
|
|
eb63890 |
|
|
|
eb63890 |
if (nladdr.nl_pid) {
|
|
|
eb63890 |
avc_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: warning: received spoofed netlink packet from: %d\n",
|
|
|
eb63890 |
+ "%s: warning: received spoofed netlink packet from: %u\n",
|
|
|
eb63890 |
avc_prefix, nladdr.nl_pid);
|
|
|
eb63890 |
return -1;
|
|
|
eb63890 |
}
|
|
|
eb63890 |
@@ -197,7 +197,7 @@ static int avc_netlink_process(char *buf)
|
|
|
eb63890 |
case SELNL_MSG_POLICYLOAD:{
|
|
|
eb63890 |
struct selnl_msg_policyload *msg = NLMSG_DATA(nlh);
|
|
|
eb63890 |
avc_log(SELINUX_INFO,
|
|
|
eb63890 |
- "%s: received policyload notice (seqno=%d)\n",
|
|
|
eb63890 |
+ "%s: received policyload notice (seqno=%u)\n",
|
|
|
eb63890 |
avc_prefix, msg->seqno);
|
|
|
eb63890 |
rc = avc_ss_reset(msg->seqno);
|
|
|
eb63890 |
if (rc < 0) {
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/avc_sidtab.c libselinux-2.4/src/avc_sidtab.c
|
|
|
eb63890 |
index 52f21df..c775430 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/avc_sidtab.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/avc_sidtab.c
|
|
|
ee8c867 |
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
|
|
|
ee8c867 |
int hvalue, rc = 0;
|
|
|
ee8c867 |
struct sidtab_node *cur;
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if (! ctx) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
*sid = NULL;
|
|
|
ee8c867 |
hvalue = sidtab_hash(ctx);
|
|
|
ee8c867 |
|
|
|
eb63890 |
@@ -124,7 +129,7 @@ void sidtab_sid_stats(struct sidtab *h, char *buf, int buflen)
|
|
|
eb63890 |
}
|
|
|
eb63890 |
|
|
|
eb63890 |
snprintf(buf, buflen,
|
|
|
eb63890 |
- "%s: %d SID entries and %d/%d buckets used, longest "
|
|
|
eb63890 |
+ "%s: %u SID entries and %d/%d buckets used, longest "
|
|
|
eb63890 |
"chain length %d\n", avc_prefix, h->nel, slots_used,
|
|
|
eb63890 |
SIDTAB_SIZE, max_chain_len);
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/canonicalize_context.c libselinux-2.4/src/canonicalize_context.c
|
|
|
13a8a0f |
index 7cf3139..364a746 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/canonicalize_context.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/canonicalize_context.c
|
|
|
13a8a0f |
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
|
|
|
ee8c867 |
size_t size;
|
|
|
ee8c867 |
int fd, ret;
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if (! con) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
if (!selinux_mnt) {
|
|
|
ee8c867 |
errno = ENOENT;
|
|
|
ee8c867 |
return -1;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/check_context.c libselinux-2.4/src/check_context.c
|
|
|
13a8a0f |
index 52063fa..234749c 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/check_context.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/check_context.c
|
|
|
13a8a0f |
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
|
|
|
ee8c867 |
char path[PATH_MAX];
|
|
|
ee8c867 |
int fd, ret;
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if (! con) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
if (!selinux_mnt) {
|
|
|
ee8c867 |
errno = ENOENT;
|
|
|
ee8c867 |
return -1;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/compute_av.c libselinux-2.4/src/compute_av.c
|
|
|
13a8a0f |
index 937e5c3..35ace7f 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/compute_av.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/compute_av.c
|
|
|
13a8a0f |
@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon,
|
|
|
ee8c867 |
return -1;
|
|
|
ee8c867 |
}
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if ((! scon) || (! tcon)) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
snprintf(path, sizeof path, "%s/access", selinux_mnt);
|
|
|
ee8c867 |
fd = open(path, O_RDWR);
|
|
|
ee8c867 |
if (fd < 0)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/compute_create.c libselinux-2.4/src/compute_create.c
|
|
|
13a8a0f |
index 9559d42..14a65d1 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/compute_create.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/compute_create.c
|
|
|
13a8a0f |
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
|
|
|
ee8c867 |
return -1;
|
|
|
ee8c867 |
}
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if ((! scon) || (! tcon)) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
snprintf(path, sizeof path, "%s/create", selinux_mnt);
|
|
|
ee8c867 |
fd = open(path, O_RDWR);
|
|
|
ee8c867 |
if (fd < 0)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/compute_member.c libselinux-2.4/src/compute_member.c
|
|
|
13a8a0f |
index 1fc7e41..065d996 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/compute_member.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/compute_member.c
|
|
|
13a8a0f |
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
|
|
|
ee8c867 |
return -1;
|
|
|
ee8c867 |
}
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if ((! scon) || (! tcon)) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
snprintf(path, sizeof path, "%s/member", selinux_mnt);
|
|
|
ee8c867 |
fd = open(path, O_RDWR);
|
|
|
ee8c867 |
if (fd < 0)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/compute_relabel.c libselinux-2.4/src/compute_relabel.c
|
|
|
13a8a0f |
index 4615aee..cc77f36 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/compute_relabel.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/compute_relabel.c
|
|
|
13a8a0f |
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
|
|
|
ee8c867 |
return -1;
|
|
|
ee8c867 |
}
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if ((! scon) || (! tcon)) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
|
|
|
ee8c867 |
fd = open(path, O_RDWR);
|
|
|
ee8c867 |
if (fd < 0)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/compute_user.c libselinux-2.4/src/compute_user.c
|
|
|
13a8a0f |
index b37c5d3..7703c26 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/compute_user.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/compute_user.c
|
|
|
13a8a0f |
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
|
|
|
ee8c867 |
return -1;
|
|
|
ee8c867 |
}
|
|
|
ee8c867 |
|
|
|
ee8c867 |
+ if (! scon) {
|
|
|
ee8c867 |
+ errno=EINVAL;
|
|
|
ee8c867 |
+ return -1;
|
|
|
ee8c867 |
+ }
|
|
|
ee8c867 |
+
|
|
|
ee8c867 |
snprintf(path, sizeof path, "%s/user", selinux_mnt);
|
|
|
ee8c867 |
fd = open(path, O_RDWR);
|
|
|
ee8c867 |
if (fd < 0)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/enabled.c libselinux-2.4/src/enabled.c
|
|
|
07d81e8 |
index 5c252dd..bb659a9 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/enabled.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/enabled.c
|
|
|
07d81e8 |
@@ -11,26 +11,14 @@
|
|
|
eb63890 |
|
|
|
eb63890 |
int is_selinux_enabled(void)
|
|
|
eb63890 |
{
|
|
|
eb63890 |
- int enabled = 0;
|
|
|
eb63890 |
- char * con;
|
|
|
eb63890 |
-
|
|
|
eb63890 |
/* init_selinuxmnt() gets called before this function. We
|
|
|
eb63890 |
* will assume that if a selinux file system is mounted, then
|
|
|
eb63890 |
* selinux is enabled. */
|
|
|
eb63890 |
- if (selinux_mnt) {
|
|
|
eb63890 |
-
|
|
|
eb63890 |
- /* Since a file system is mounted, we consider selinux
|
|
|
eb63890 |
- * enabled. If getcon_raw fails, selinux is still enabled.
|
|
|
eb63890 |
- * We only consider it disabled if no policy is loaded. */
|
|
|
eb63890 |
- enabled = 1;
|
|
|
eb63890 |
- if (getcon_raw(&con) == 0) {
|
|
|
eb63890 |
- if (!strcmp(con, "kernel"))
|
|
|
eb63890 |
- enabled = 0;
|
|
|
eb63890 |
- freecon(con);
|
|
|
eb63890 |
- }
|
|
|
eb63890 |
- }
|
|
|
eb63890 |
-
|
|
|
eb63890 |
- return enabled;
|
|
|
07d81e8 |
+#ifdef ANDROID
|
|
|
eb63890 |
+ return (selinux_mnt ? 1 : 0);
|
|
|
07d81e8 |
+#else
|
|
|
07d81e8 |
+ return (selinux_mnt && has_selinux_config);
|
|
|
07d81e8 |
+#endif
|
|
|
eb63890 |
}
|
|
|
eb63890 |
|
|
|
eb63890 |
hidden_def(is_selinux_enabled)
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/file_path_suffixes.h libselinux-2.4/src/file_path_suffixes.h
|
|
|
aa0f5b6 |
index 3c92424..d1f9b48 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/file_path_suffixes.h
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/file_path_suffixes.h
|
|
|
aa0f5b6 |
@@ -23,6 +23,7 @@ S_(BINPOLICY, "/policy/policy")
|
|
|
aa0f5b6 |
S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context")
|
|
|
aa0f5b6 |
S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context")
|
|
|
aa0f5b6 |
S_(LXC_CONTEXTS, "/contexts/lxc_contexts")
|
|
|
aa0f5b6 |
+ S_(OPENSSH_CONTEXTS, "/contexts/openssh_contexts")
|
|
|
aa0f5b6 |
S_(SYSTEMD_CONTEXTS, "/contexts/systemd_contexts")
|
|
|
aa0f5b6 |
S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs")
|
|
|
aa0f5b6 |
S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist")
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/fsetfilecon.c libselinux-2.4/src/fsetfilecon.c
|
|
|
13a8a0f |
index 52707d0..0cbe12d 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/fsetfilecon.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/fsetfilecon.c
|
|
|
7e1165a |
@@ -9,8 +9,12 @@
|
|
|
7e1165a |
|
|
|
ed9898e |
int fsetfilecon_raw(int fd, const char * context)
|
|
|
7e1165a |
{
|
|
|
7e1165a |
- int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
|
|
7e1165a |
- 0);
|
|
|
7e1165a |
+ int rc;
|
|
|
7e1165a |
+ if (! context) {
|
|
|
7e1165a |
+ errno=EINVAL;
|
|
|
7e1165a |
+ return -1;
|
|
|
7e1165a |
+ }
|
|
|
7e1165a |
+ rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
|
|
7e1165a |
if (rc < 0 && errno == ENOTSUP) {
|
|
|
ed9898e |
char * ccontext = NULL;
|
|
|
7e1165a |
int err = errno;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/init.c libselinux-2.4/src/init.c
|
|
|
07d81e8 |
index 6d1ef33..3c687a2 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/init.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/init.c
|
|
|
07d81e8 |
@@ -21,6 +21,8 @@ char *selinux_mnt = NULL;
|
|
|
07d81e8 |
int selinux_page_size = 0;
|
|
|
07d81e8 |
int obj_class_compat = 1;
|
|
|
07d81e8 |
|
|
|
07d81e8 |
+int has_selinux_config = 0;
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
/* Verify the mount point for selinux file system has a selinuxfs.
|
|
|
07d81e8 |
If the file system:
|
|
|
07d81e8 |
* Exist,
|
|
|
07d81e8 |
@@ -151,6 +153,9 @@ static void init_lib(void)
|
|
|
07d81e8 |
{
|
|
|
07d81e8 |
selinux_page_size = sysconf(_SC_PAGE_SIZE);
|
|
|
07d81e8 |
init_selinuxmnt();
|
|
|
07d81e8 |
+#ifndef ANDROID
|
|
|
07d81e8 |
+ has_selinux_config = (access(SELINUXCONFIG, F_OK) == 0);
|
|
|
07d81e8 |
+#endif
|
|
|
07d81e8 |
}
|
|
|
07d81e8 |
|
|
|
07d81e8 |
static void fini_lib(void) __attribute__ ((destructor));
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/label_android_property.c libselinux-2.4/src/label_android_property.c
|
|
|
eb63890 |
index b00eb07..5e1b76e 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/label_android_property.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/label_android_property.c
|
|
|
eb63890 |
@@ -101,7 +101,7 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
items = sscanf(line_buf, "%255s %255s", prop, context);
|
|
|
eb63890 |
if (items != 2) {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d is missing fields, skipping\n", path,
|
|
|
eb63890 |
+ "%s: line %u is missing fields, skipping\n", path,
|
|
|
eb63890 |
lineno);
|
|
|
eb63890 |
return 0;
|
|
|
eb63890 |
}
|
|
|
eb63890 |
@@ -111,7 +111,7 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
spec_arr[nspec].property_key = strdup(prop);
|
|
|
eb63890 |
if (!spec_arr[nspec].property_key) {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: out of memory at line %d on prop %s\n",
|
|
|
eb63890 |
+ "%s: out of memory at line %u on prop %s\n",
|
|
|
eb63890 |
path, lineno, prop);
|
|
|
eb63890 |
return -1;
|
|
|
eb63890 |
|
|
|
eb63890 |
@@ -120,7 +120,7 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
spec_arr[nspec].lr.ctx_raw = strdup(context);
|
|
|
eb63890 |
if (!spec_arr[nspec].lr.ctx_raw) {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: out of memory at line %d on context %s\n",
|
|
|
eb63890 |
+ "%s: out of memory at line %u on context %s\n",
|
|
|
eb63890 |
path, lineno, context);
|
|
|
eb63890 |
return -1;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/label_db.c libselinux-2.4/src/label_db.c
|
|
|
c9ef5a0 |
index 999dd46..1b48735 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/label_db.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/label_db.c
|
|
|
eb63890 |
@@ -105,12 +105,12 @@ process_line(const char *path, char *line_buf, unsigned int line_num,
|
|
|
eb63890 |
* <object class> <object name> <security context>
|
|
|
eb63890 |
*/
|
|
|
eb63890 |
type = key = context = temp = NULL;
|
|
|
eb63890 |
- items = sscanf(line_buf, "%as %as %as %as",
|
|
|
eb63890 |
+ items = sscanf(line_buf, "%ms %ms %ms %ms",
|
|
|
eb63890 |
&type, &key, &context, &temp);
|
|
|
eb63890 |
if (items != 3) {
|
|
|
eb63890 |
if (items > 0)
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d has invalid format, skipped",
|
|
|
eb63890 |
+ "%s: line %u has invalid format, skipped",
|
|
|
eb63890 |
path, line_num);
|
|
|
eb63890 |
goto skip;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
@@ -146,7 +146,7 @@ process_line(const char *path, char *line_buf, unsigned int line_num,
|
|
|
c9ef5a0 |
spec->type = SELABEL_DB_DATATYPE;
|
|
|
eb63890 |
else {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d has invalid object type %s\n",
|
|
|
eb63890 |
+ "%s: line %u has invalid object type %s\n",
|
|
|
eb63890 |
path, line_num, type);
|
|
|
eb63890 |
goto skip;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/label_file.c libselinux-2.4/src/label_file.c
|
|
|
c9ef5a0 |
index 8e7b288..2a43310 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/label_file.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/label_file.c
|
|
|
eb63890 |
@@ -170,10 +170,10 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
/* Skip comment lines and empty lines. */
|
|
|
eb63890 |
if (*buf_p == '#' || *buf_p == 0)
|
|
|
eb63890 |
return 0;
|
|
|
eb63890 |
- items = sscanf(line_buf, "%as %as %as", ®ex, &type, &context);
|
|
|
eb63890 |
+ items = sscanf(line_buf, "%ms %ms %ms", ®ex, &type, &context);
|
|
|
eb63890 |
if (items < 2) {
|
|
|
eb63890 |
COMPAT_LOG(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d is missing fields, skipping\n", path,
|
|
|
eb63890 |
+ "%s: line %u is missing fields, skipping\n", path,
|
|
|
eb63890 |
lineno);
|
|
|
eb63890 |
if (items == 1)
|
|
|
eb63890 |
free(regex);
|
|
|
eb63890 |
@@ -204,7 +204,7 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
spec_arr[nspec].stem_id = find_stem_from_spec(data, regex);
|
|
|
eb63890 |
spec_arr[nspec].regex_str = regex;
|
|
|
eb63890 |
if (rec->validating && compile_regex(data, &spec_arr[nspec], &errbuf)) {
|
|
|
eb63890 |
- COMPAT_LOG(SELINUX_WARNING, "%s: line %d has invalid regex %s: %s\n",
|
|
|
eb63890 |
+ COMPAT_LOG(SELINUX_WARNING, "%s: line %u has invalid regex %s: %s\n",
|
|
|
eb63890 |
path, lineno, regex, (errbuf ? errbuf : "out of memory"));
|
|
|
eb63890 |
}
|
|
|
eb63890 |
|
|
|
eb63890 |
@@ -214,7 +214,7 @@ static int process_line(struct selabel_handle *rec,
|
|
|
eb63890 |
if (type) {
|
|
|
eb63890 |
mode_t mode = string_to_mode(type);
|
|
|
c9ef5a0 |
if (mode == (mode_t)-1) {
|
|
|
eb63890 |
- COMPAT_LOG(SELINUX_WARNING, "%s: line %d has invalid file type %s\n",
|
|
|
eb63890 |
+ COMPAT_LOG(SELINUX_WARNING, "%s: line %u has invalid file type %s\n",
|
|
|
eb63890 |
path, lineno, type);
|
|
|
eb63890 |
mode = 0;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/label_media.c libselinux-2.4/src/label_media.c
|
|
|
eb63890 |
index 227785f..a09486b 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/label_media.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/label_media.c
|
|
|
eb63890 |
@@ -44,10 +44,10 @@ static int process_line(const char *path, char *line_buf, int pass,
|
|
|
eb63890 |
/* Skip comment lines and empty lines. */
|
|
|
eb63890 |
if (*buf_p == '#' || *buf_p == 0)
|
|
|
eb63890 |
return 0;
|
|
|
eb63890 |
- items = sscanf(line_buf, "%as %as ", &key, &context);
|
|
|
eb63890 |
+ items = sscanf(line_buf, "%ms %ms ", &key, &context);
|
|
|
eb63890 |
if (items < 2) {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d is missing fields, skipping\n", path,
|
|
|
eb63890 |
+ "%s: line %u is missing fields, skipping\n", path,
|
|
|
eb63890 |
lineno);
|
|
|
eb63890 |
if (items == 1)
|
|
|
eb63890 |
free(key);
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/label_x.c libselinux-2.4/src/label_x.c
|
|
|
eb63890 |
index 896ef02..8435b76 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/label_x.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/label_x.c
|
|
|
eb63890 |
@@ -46,10 +46,10 @@ static int process_line(const char *path, char *line_buf, int pass,
|
|
|
eb63890 |
/* Skip comment lines and empty lines. */
|
|
|
eb63890 |
if (*buf_p == '#' || *buf_p == 0)
|
|
|
eb63890 |
return 0;
|
|
|
eb63890 |
- items = sscanf(line_buf, "%as %as %as ", &type, &key, &context);
|
|
|
eb63890 |
+ items = sscanf(line_buf, "%ms %ms %ms ", &type, &key, &context);
|
|
|
eb63890 |
if (items < 3) {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d is missing fields, skipping\n", path,
|
|
|
eb63890 |
+ "%s: line %u is missing fields, skipping\n", path,
|
|
|
eb63890 |
lineno);
|
|
|
eb63890 |
if (items > 0)
|
|
|
eb63890 |
free(type);
|
|
|
eb63890 |
@@ -76,7 +76,7 @@ static int process_line(const char *path, char *line_buf, int pass,
|
|
|
eb63890 |
data->spec_arr[data->nspec].type = SELABEL_X_POLYSELN;
|
|
|
eb63890 |
else {
|
|
|
eb63890 |
selinux_log(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d has invalid object type %s\n",
|
|
|
eb63890 |
+ "%s: line %u has invalid object type %s\n",
|
|
|
eb63890 |
path, lineno, type);
|
|
|
eb63890 |
return 0;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/lsetfilecon.c libselinux-2.4/src/lsetfilecon.c
|
|
|
13a8a0f |
index 1d3b28a..ea6d70b 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/lsetfilecon.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/lsetfilecon.c
|
|
|
7e1165a |
@@ -9,8 +9,13 @@
|
|
|
e61de3d |
|
|
|
ed9898e |
int lsetfilecon_raw(const char *path, const char * context)
|
|
|
e61de3d |
{
|
|
|
e61de3d |
- int rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
|
|
7e1165a |
- 0);
|
|
|
e61de3d |
+ int rc;
|
|
|
e61de3d |
+ if (! context) {
|
|
|
e61de3d |
+ errno=EINVAL;
|
|
|
e61de3d |
+ return -1;
|
|
|
e61de3d |
+ }
|
|
|
e61de3d |
+
|
|
|
7e1165a |
+ rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
|
|
e61de3d |
if (rc < 0 && errno == ENOTSUP) {
|
|
|
ed9898e |
char * ccontext = NULL;
|
|
|
7e1165a |
int err = errno;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/matchpathcon.c libselinux-2.4/src/matchpathcon.c
|
|
|
eb63890 |
index 3b96b1d..3868711 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/matchpathcon.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/matchpathcon.c
|
|
|
495b754 |
@@ -2,6 +2,7 @@
|
|
|
974a6e4 |
#include <string.h>
|
|
|
974a6e4 |
#include <errno.h>
|
|
|
974a6e4 |
#include <stdio.h>
|
|
|
974a6e4 |
+#include <syslog.h>
|
|
|
974a6e4 |
#include "selinux_internal.h"
|
|
|
974a6e4 |
#include "label_internal.h"
|
|
|
974a6e4 |
#include "callbacks.h"
|
|
|
495b754 |
@@ -62,7 +63,7 @@ static void
|
|
|
974a6e4 |
{
|
|
|
974a6e4 |
va_list ap;
|
|
|
974a6e4 |
va_start(ap, fmt);
|
|
|
974a6e4 |
- vfprintf(stderr, fmt, ap);
|
|
|
974a6e4 |
+ vsyslog(LOG_ERR, fmt, ap);
|
|
|
974a6e4 |
va_end(ap);
|
|
|
974a6e4 |
}
|
|
|
b5b41bc |
|
|
|
eb63890 |
@@ -541,7 +542,7 @@ int compat_validate(struct selabel_handle *rec,
|
|
|
eb63890 |
if (rc < 0) {
|
|
|
eb63890 |
if (lineno) {
|
|
|
eb63890 |
COMPAT_LOG(SELINUX_WARNING,
|
|
|
eb63890 |
- "%s: line %d has invalid context %s\n",
|
|
|
eb63890 |
+ "%s: line %u has invalid context %s\n",
|
|
|
eb63890 |
path, lineno, *ctx);
|
|
|
eb63890 |
} else {
|
|
|
eb63890 |
COMPAT_LOG(SELINUX_WARNING,
|
|
|
8db7ce6 |
diff --git libselinux-2.4/src/procattr.c libselinux-2.4/src/procattr.c
|
|
|
8db7ce6 |
index f990350..527a0a5 100644
|
|
|
8db7ce6 |
--- libselinux-2.4/src/procattr.c
|
|
|
8db7ce6 |
+++ libselinux-2.4/src/procattr.c
|
|
|
8db7ce6 |
@@ -11,8 +11,6 @@
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
#define UNSET (char *) -1
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
-static __thread pid_t cpid;
|
|
|
8db7ce6 |
-static __thread pid_t tid;
|
|
|
8db7ce6 |
static __thread char *prev_current = UNSET;
|
|
|
8db7ce6 |
static __thread char * prev_exec = UNSET;
|
|
|
8db7ce6 |
static __thread char * prev_fscreate = UNSET;
|
|
|
8db7ce6 |
@@ -24,15 +22,6 @@ static pthread_key_t destructor_key;
|
|
|
8db7ce6 |
static int destructor_key_initialized = 0;
|
|
|
8db7ce6 |
static __thread char destructor_initialized;
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
-extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
|
|
|
8db7ce6 |
-extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
-static int __selinux_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
|
|
|
8db7ce6 |
-{
|
|
|
8db7ce6 |
- return __register_atfork (prepare, parent, child,
|
|
|
8db7ce6 |
- &__dso_handle == NULL ? NULL : __dso_handle);
|
|
|
8db7ce6 |
-}
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
static pid_t gettid(void)
|
|
|
8db7ce6 |
{
|
|
|
8db7ce6 |
return syscall(__NR_gettid);
|
|
|
8db7ce6 |
@@ -52,14 +41,6 @@ static void procattr_thread_destructor(void __attribute__((unused)) *unused)
|
|
|
8db7ce6 |
free(prev_sockcreate);
|
|
|
8db7ce6 |
}
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
-static void free_procattr(void)
|
|
|
8db7ce6 |
-{
|
|
|
8db7ce6 |
- procattr_thread_destructor(NULL);
|
|
|
8db7ce6 |
- tid = 0;
|
|
|
8db7ce6 |
- cpid = getpid();
|
|
|
8db7ce6 |
- prev_current = prev_exec = prev_fscreate = prev_keycreate = prev_sockcreate = UNSET;
|
|
|
8db7ce6 |
-}
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
void __attribute__((destructor)) procattr_destructor(void);
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
void hidden __attribute__((destructor)) procattr_destructor(void)
|
|
|
8db7ce6 |
@@ -79,7 +60,6 @@ static inline void init_thread_destructor(void)
|
|
|
8db7ce6 |
static void init_procattr(void)
|
|
|
8db7ce6 |
{
|
|
|
8db7ce6 |
if (__selinux_key_create(&destructor_key, procattr_thread_destructor) == 0) {
|
|
|
8db7ce6 |
- __selinux_atfork(NULL, NULL, free_procattr);
|
|
|
8db7ce6 |
destructor_key_initialized = 1;
|
|
|
8db7ce6 |
}
|
|
|
8db7ce6 |
}
|
|
|
8db7ce6 |
@@ -88,21 +68,26 @@ static int openattr(pid_t pid, const char *attr, int flags)
|
|
|
8db7ce6 |
{
|
|
|
8db7ce6 |
int fd, rc;
|
|
|
8db7ce6 |
char *path;
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
- if (cpid != getpid())
|
|
|
8db7ce6 |
- free_procattr();
|
|
|
8db7ce6 |
+ pid_t tid;
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
if (pid > 0)
|
|
|
8db7ce6 |
rc = asprintf(&path, "/proc/%d/attr/%s", pid, attr);
|
|
|
8db7ce6 |
else {
|
|
|
8db7ce6 |
- if (!tid)
|
|
|
8db7ce6 |
- tid = gettid();
|
|
|
8db7ce6 |
+ rc = asprintf(&path, "/proc/thread-self/attr/%s", attr);
|
|
|
8db7ce6 |
+ if (rc < 0)
|
|
|
8db7ce6 |
+ return -1;
|
|
|
8db7ce6 |
+ fd = open(path, flags | O_CLOEXEC);
|
|
|
8db7ce6 |
+ if (fd >= 0 || errno != ENOENT)
|
|
|
8db7ce6 |
+ goto out;
|
|
|
8db7ce6 |
+ free(path);
|
|
|
8db7ce6 |
+ tid = gettid();
|
|
|
8db7ce6 |
rc = asprintf(&path, "/proc/self/task/%d/attr/%s", tid, attr);
|
|
|
8db7ce6 |
}
|
|
|
8db7ce6 |
if (rc < 0)
|
|
|
8db7ce6 |
return -1;
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
fd = open(path, flags | O_CLOEXEC);
|
|
|
8db7ce6 |
+out:
|
|
|
8db7ce6 |
free(path);
|
|
|
8db7ce6 |
return fd;
|
|
|
8db7ce6 |
}
|
|
|
8db7ce6 |
@@ -120,9 +105,6 @@ static int getprocattrcon_raw(char ** context,
|
|
|
8db7ce6 |
__selinux_once(once, init_procattr);
|
|
|
8db7ce6 |
init_thread_destructor();
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
- if (cpid != getpid())
|
|
|
8db7ce6 |
- free_procattr();
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
switch (attr[0]) {
|
|
|
8db7ce6 |
case 'c':
|
|
|
8db7ce6 |
prev_context = prev_current;
|
|
|
8db7ce6 |
@@ -220,9 +202,6 @@ static int setprocattrcon_raw(const char * context,
|
|
|
8db7ce6 |
__selinux_once(once, init_procattr);
|
|
|
8db7ce6 |
init_thread_destructor();
|
|
|
8db7ce6 |
|
|
|
8db7ce6 |
- if (cpid != getpid())
|
|
|
8db7ce6 |
- free_procattr();
|
|
|
8db7ce6 |
-
|
|
|
8db7ce6 |
switch (attr[0]) {
|
|
|
8db7ce6 |
case 'c':
|
|
|
8db7ce6 |
prev_context = &prev_current;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/selinux_config.c libselinux-2.4/src/selinux_config.c
|
|
|
07d81e8 |
index 30e9dc7..bec5f3b 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/selinux_config.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/selinux_config.c
|
|
|
07d81e8 |
@@ -13,8 +13,6 @@
|
|
|
07d81e8 |
#include "selinux_internal.h"
|
|
|
07d81e8 |
#include "get_default_type_internal.h"
|
|
|
07d81e8 |
|
|
|
07d81e8 |
-#define SELINUXDIR "/etc/selinux/"
|
|
|
07d81e8 |
-#define SELINUXCONFIG SELINUXDIR "config"
|
|
|
07d81e8 |
#define SELINUXDEFAULT "targeted"
|
|
|
07d81e8 |
#define SELINUXTYPETAG "SELINUXTYPE="
|
|
|
07d81e8 |
#define SELINUXTAG "SELINUX="
|
|
|
07d81e8 |
@@ -50,8 +48,9 @@
|
|
|
aa0f5b6 |
#define FILE_CONTEXT_SUBS_DIST 25
|
|
|
aa0f5b6 |
#define LXC_CONTEXTS 26
|
|
|
aa0f5b6 |
#define BOOLEAN_SUBS 27
|
|
|
aa0f5b6 |
-#define SYSTEMD_CONTEXTS 28
|
|
|
aa0f5b6 |
-#define NEL 29
|
|
|
aa0f5b6 |
+#define OPENSSH_CONTEXTS 28
|
|
|
aa0f5b6 |
+#define SYSTEMD_CONTEXTS 29
|
|
|
aa0f5b6 |
+#define NEL 30
|
|
|
aa0f5b6 |
|
|
|
aa0f5b6 |
/* Part of one-time lazy init */
|
|
|
aa0f5b6 |
static pthread_once_t once = PTHREAD_ONCE_INIT;
|
|
|
07d81e8 |
@@ -493,6 +492,13 @@ const char *selinux_lxc_contexts_path(void)
|
|
|
aa0f5b6 |
|
|
|
aa0f5b6 |
hidden_def(selinux_lxc_contexts_path)
|
|
|
aa0f5b6 |
|
|
|
aa0f5b6 |
+const char *selinux_openssh_contexts_path(void)
|
|
|
aa0f5b6 |
+{
|
|
|
aa0f5b6 |
+ return get_path(OPENSSH_CONTEXTS);
|
|
|
aa0f5b6 |
+}
|
|
|
aa0f5b6 |
+
|
|
|
aa0f5b6 |
+hidden_def(selinux_openssh_contexts_path)
|
|
|
aa0f5b6 |
+
|
|
|
aa0f5b6 |
const char *selinux_systemd_contexts_path(void)
|
|
|
aa0f5b6 |
{
|
|
|
aa0f5b6 |
return get_path(SYSTEMD_CONTEXTS);
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/selinux_internal.h libselinux-2.4/src/selinux_internal.h
|
|
|
07d81e8 |
index afb2170..9b1ca4d 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/selinux_internal.h
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/selinux_internal.h
|
|
|
aa0f5b6 |
@@ -82,6 +82,7 @@ hidden_proto(selinux_mkload_policy)
|
|
|
aa0f5b6 |
hidden_proto(selinux_customizable_types_path)
|
|
|
aa0f5b6 |
hidden_proto(selinux_media_context_path)
|
|
|
aa0f5b6 |
hidden_proto(selinux_x_context_path)
|
|
|
aa0f5b6 |
+ hidden_proto(selinux_openssh_contexts_path)
|
|
|
aa0f5b6 |
hidden_proto(selinux_sepgsql_context_path)
|
|
|
aa0f5b6 |
hidden_proto(selinux_systemd_contexts_path)
|
|
|
aa0f5b6 |
hidden_proto(selinux_path)
|
|
|
07d81e8 |
@@ -137,3 +138,8 @@ extern int selinux_page_size hidden;
|
|
|
07d81e8 |
if (pthread_setspecific != NULL) \
|
|
|
07d81e8 |
pthread_setspecific(KEY, VALUE); \
|
|
|
07d81e8 |
} while (0)
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
+#define SELINUXDIR "/etc/selinux/"
|
|
|
07d81e8 |
+#define SELINUXCONFIG SELINUXDIR "config"
|
|
|
07d81e8 |
+
|
|
|
07d81e8 |
+extern int has_selinux_config hidden;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/selinuxswig_python.i libselinux-2.4/src/selinuxswig_python.i
|
|
|
eb63890 |
index ae72246..c9a2341 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/selinuxswig_python.i
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/selinuxswig_python.i
|
|
|
eb63890 |
@@ -31,9 +31,9 @@ def restorecon(path, recursive=False):
|
|
|
eb63890 |
lsetfilecon(path, context)
|
|
|
eb63890 |
|
|
|
eb63890 |
if recursive:
|
|
|
eb63890 |
- os.path.walk(path, lambda arg, dirname, fnames:
|
|
|
eb63890 |
- map(restorecon, [os.path.join(dirname, fname)
|
|
|
eb63890 |
- for fname in fnames]), None)
|
|
|
eb63890 |
+ for root, dirs, files in os.walk(path):
|
|
|
eb63890 |
+ for name in files + dirs:
|
|
|
eb63890 |
+ restorecon(os.path.join(root, name))
|
|
|
eb63890 |
|
|
|
eb63890 |
def chcon(path, context, recursive=False):
|
|
|
eb63890 |
""" Set the SELinux context on a given path """
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/src/setfilecon.c libselinux-2.4/src/setfilecon.c
|
|
|
13a8a0f |
index d05969c..3f0200e 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/src/setfilecon.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/src/setfilecon.c
|
|
|
7e1165a |
@@ -9,8 +9,12 @@
|
|
|
7e1165a |
|
|
|
ed9898e |
int setfilecon_raw(const char *path, const char * context)
|
|
|
7e1165a |
{
|
|
|
7e1165a |
- int rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
|
|
7e1165a |
- 0);
|
|
|
7e1165a |
+ int rc;
|
|
|
7e1165a |
+ if (! context) {
|
|
|
7e1165a |
+ errno=EINVAL;
|
|
|
7e1165a |
+ return -1;
|
|
|
7e1165a |
+ }
|
|
|
7e1165a |
+ rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
|
|
7e1165a |
if (rc < 0 && errno == ENOTSUP) {
|
|
|
ed9898e |
char * ccontext = NULL;
|
|
|
7e1165a |
int err = errno;
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/utils/Makefile libselinux-2.4/utils/Makefile
|
|
|
eb63890 |
index f469924..5499538 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/utils/Makefile
|
|
|
c9ef5a0 |
+++ libselinux-2.4/utils/Makefile
|
|
|
eb63890 |
@@ -11,7 +11,7 @@ CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissi
|
|
|
eb63890 |
-Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
|
|
|
eb63890 |
-Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
|
|
|
eb63890 |
-Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
|
|
|
eb63890 |
- -Wdisabled-optimization -Wbuiltin-macro-redefined -Wmudflap -Wpacked-bitfield-compat \
|
|
|
eb63890 |
+ -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
|
|
|
eb63890 |
-Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
|
|
|
eb63890 |
-Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
|
|
|
eb63890 |
-Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/utils/sefcontext_compile.c libselinux-2.4/utils/sefcontext_compile.c
|
|
|
c9ef5a0 |
index 504699d..adb2b0c 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/utils/sefcontext_compile.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/utils/sefcontext_compile.c
|
|
|
c9ef5a0 |
@@ -73,7 +73,7 @@ static int process_file(struct saved_data *data, const char *filename)
|
|
|
eb63890 |
spec->lr.ctx_raw = context;
|
|
|
eb63890 |
spec->mode = string_to_mode(mode);
|
|
|
c9ef5a0 |
if (spec->mode == (mode_t)-1) {
|
|
|
eb63890 |
- fprintf(stderr, "%s: line %d has invalid file type %s\n",
|
|
|
eb63890 |
+ fprintf(stderr, "%s: line %u has invalid file type %s\n",
|
|
|
eb63890 |
regex, line_num + 1, mode);
|
|
|
eb63890 |
spec->mode = 0;
|
|
|
eb63890 |
}
|
|
|
c9ef5a0 |
diff --git libselinux-2.4/utils/togglesebool.c libselinux-2.4/utils/togglesebool.c
|
|
|
eb63890 |
index ad0d2a2..309f83b 100644
|
|
|
c9ef5a0 |
--- libselinux-2.4/utils/togglesebool.c
|
|
|
c9ef5a0 |
+++ libselinux-2.4/utils/togglesebool.c
|
|
|
eb63890 |
@@ -86,7 +86,7 @@ int main(int argc, char **argv)
|
|
|
eb63890 |
argv[i], pwd->pw_name);
|
|
|
eb63890 |
else
|
|
|
eb63890 |
syslog(LOG_NOTICE,
|
|
|
eb63890 |
- "The %s policy boolean was toggled by uid:%d",
|
|
|
eb63890 |
+ "The %s policy boolean was toggled by uid:%u",
|
|
|
eb63890 |
argv[i], getuid());
|
|
|
eb63890 |
|
|
|
eb63890 |
}
|