diff --git a/libselinux-rhat.patch b/libselinux-rhat.patch index c6a6088..4ac818f 100644 --- a/libselinux-rhat.patch +++ b/libselinux-rhat.patch @@ -15,7 +15,7 @@ index 1a54307..f6eeb21 100644 /* * Label operations diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h -index 6f483c9..fbcd3ac 100644 +index 6f483c9..9756ac9 100644 --- a/libselinux/include/selinux/selinux.h +++ b/libselinux/include/selinux/selinux.h @@ -139,7 +139,10 @@ struct av_decision { @@ -50,6 +50,19 @@ index 6f483c9..fbcd3ac 100644 extern const char *selinux_binary_policy_path(void); extern const char *selinux_failsafe_context_path(void); extern const char *selinux_removable_context_path(void); +@@ -502,10 +511,12 @@ extern const char *selinux_homedir_context_path(void); + extern const char *selinux_media_context_path(void); + extern const char *selinux_virtual_domain_context_path(void); + extern const char *selinux_virtual_image_context_path(void); ++extern const char *selinux_lxc_contexts_path(void); + extern const char *selinux_x_context_path(void); + extern const char *selinux_sepgsql_context_path(void); + extern const char *selinux_contexts_path(void); + extern const char *selinux_securetty_types_path(void); ++extern const char *selinux_booleans_subs_path(void); + extern const char *selinux_booleans_path(void); + extern const char *selinux_customizable_types_path(void); + extern const char *selinux_users_path(void); diff --git a/libselinux/man/man3/matchpathcon.3 b/libselinux/man/man3/matchpathcon.3 index cdbb252..b6814ed 100644 --- a/libselinux/man/man3/matchpathcon.3 @@ -196,6 +209,206 @@ index be4c0a3..a07aa7f 100644 if (rc == 0 && !blocking) { errno = EWOULDBLOCK; +diff --git a/libselinux/src/booleans.c b/libselinux/src/booleans.c +index 1510043..bf526c0 100644 +--- a/libselinux/src/booleans.c ++++ b/libselinux/src/booleans.c +@@ -86,45 +86,131 @@ int security_get_boolean_names(char ***names, int *len) + } + + hidden_def(security_get_boolean_names) +-#define STRBUF_SIZE 3 +-static int get_bool_value(const char *name, char **buf) ++ ++static char * bool_sub(const char *name) + { +- int fd, len; ++ char *sub = NULL; ++ char *line_buf = NULL; ++ size_t line_len = 0; ++ FILE *cfg; ++ ++ if (!name) ++ return NULL; ++ ++ cfg = fopen(selinux_booleans_subs_path(), "r"); ++ ++ if (!cfg) ++ return NULL; ++ ++ while (getline(&line_buf, &line_len, cfg)) { ++ char *ptr = NULL; ++ char *src = line_buf; ++ char *dst = NULL; ++ ++ while (*src && isspace(*src)) ++ src++; ++ if (src[0] == '#') continue; ++ ptr = src; ++ while (*ptr && ! isspace(*ptr)) ++ ptr++; ++ *ptr++ = '\0'; ++ if (! *src || (strcmp(src, name) != 0)) ++ continue; ++ ++ dst = ptr; ++ while (*dst && isspace(*dst)) ++ dst++; ++ ptr=dst; ++ while (*ptr && ! isspace(*ptr)) ++ ptr++; ++ *ptr='\0'; ++ if (! *dst) ++ continue; ++ ++ sub = strdup(dst); ++ break; ++ } ++ ++ free(line_buf); ++ fclose(cfg); ++ return sub; ++} ++ ++static int bool_open(const char *name, int flag) { + char *fname = NULL; ++ char *alt_name = NULL; ++ int len; ++ int fd = -1; ++ char *ptr; + +- if (!selinux_mnt) { +- errno = ENOENT; +- return -1; ++ if (!name) { ++ errno = EINVAL; ++ return fd; + } + +- *buf = (char *)malloc(sizeof(char) * (STRBUF_SIZE + 1)); +- if (!*buf) +- goto out; +- (*buf)[STRBUF_SIZE] = 0; +- + len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR); + fname = (char *)malloc(sizeof(char) * len); + if (!fname) +- goto out; ++ return fd; ++ + snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name); + +- fd = open(fname, O_RDONLY); +- if (fd < 0) ++ fd = open(fname, flag); ++ if (fd >= 0 || errno != ENOENT) + goto out; + +- len = read(fd, *buf, STRBUF_SIZE); +- close(fd); +- if (len != STRBUF_SIZE) ++ alt_name = bool_sub(name); ++ if (! alt_name) + goto out; + ++ len = strlen(alt_name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR); ++ ptr = realloc(fname, len); ++ if (!ptr) ++ goto out; ++ ++ fname = ptr; ++ snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, alt_name); ++ fd = open(fname, flag); ++ ++out: + free(fname); +- return 0; ++ free(alt_name); ++ ++ return fd; ++} ++ ++#define STRBUF_SIZE 3 ++static int get_bool_value(const char *name, char **buf) ++{ ++ int fd, len; ++ int rc = -1; ++ char *bool_buf = NULL; ++ if (!selinux_mnt) { ++ errno = ENOENT; ++ return -1; ++ } ++ ++ fd = bool_open(name, O_RDONLY); ++ if (fd < 0) ++ return -1; ++ ++ bool_buf = malloc(sizeof(char) * (STRBUF_SIZE + 1)); ++ if (!bool_buf) ++ goto out; ++ bool_buf[STRBUF_SIZE] = 0; ++ ++ len = read(fd, bool_buf, STRBUF_SIZE); ++ if (len != STRBUF_SIZE) ++ goto out; ++ rc = 0; + out: +- if (*buf) +- free(*buf); +- if (fname) +- free(fname); +- return -1; ++ close(fd); ++ if (!rc) { ++ *buf = bool_buf; ++ } else { ++ free(bool_buf); ++ } ++ return rc; + } + + int security_get_boolean_pending(const char *name) +@@ -164,8 +250,8 @@ hidden_def(security_get_boolean_active) + + int security_set_boolean(const char *name, int value) + { +- int fd, ret, len; +- char buf[2], *fname; ++ int fd, ret; ++ char buf[2]; + + if (!selinux_mnt) { + errno = ENOENT; +@@ -176,17 +262,9 @@ int security_set_boolean(const char *name, int value) + return -1; + } + +- len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR); +- fname = (char *)malloc(sizeof(char) * len); +- if (!fname) ++ fd = bool_open(name, O_WRONLY); ++ if (fd < 0) + return -1; +- snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name); +- +- fd = open(fname, O_WRONLY); +- if (fd < 0) { +- ret = -1; +- goto out; +- } + + if (value) + buf[0] = '1'; +@@ -196,8 +274,7 @@ int security_set_boolean(const char *name, int value) + + ret = write(fd, buf, 2); + close(fd); +- out: +- free(fname); ++ + if (ret > 0) + return 0; + else diff --git a/libselinux/src/callbacks.c b/libselinux/src/callbacks.c index b245364..7c47222 100644 --- a/libselinux/src/callbacks.c @@ -208,6 +421,19 @@ index b245364..7c47222 100644 va_start(ap, fmt); rc = vfprintf(stderr, fmt, ap); va_end(ap); +diff --git a/libselinux/src/file_path_suffixes.h b/libselinux/src/file_path_suffixes.h +index 0b00156..825f295 100644 +--- a/libselinux/src/file_path_suffixes.h ++++ b/libselinux/src/file_path_suffixes.h +@@ -22,6 +22,8 @@ S_(BINPOLICY, "/policy/policy") + S_(COLORS, "/secolor.conf") + S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context") + S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context") ++ S_(LXC_CONTEXTS, "/contexts/lxc_contexts") + S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs") + S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist") + S_(SEPGSQL_CONTEXTS, "/contexts/sepgsql_contexts") ++ S_(BOOLEAN_SUBS, "/booleans.subs") diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c index 7bc46cc..82a608c 100644 --- a/libselinux/src/label_file.c @@ -365,7 +591,7 @@ index 8f200d4..c18ea47 100644 int matchpathcon_init(const char *path) diff --git a/libselinux/src/selinux_config.c b/libselinux/src/selinux_config.c -index f42cb7c..907b004 100644 +index f42cb7c..f544ac2 100644 --- a/libselinux/src/selinux_config.c +++ b/libselinux/src/selinux_config.c @@ -9,6 +9,7 @@ @@ -376,7 +602,18 @@ index f42cb7c..907b004 100644 #include "get_default_type_internal.h" #define SELINUXDIR "/etc/selinux/" -@@ -301,6 +302,29 @@ const char *selinux_binary_policy_path(void) +@@ -46,7 +47,9 @@ + #define FILE_CONTEXT_SUBS 23 + #define SEPGSQL_CONTEXTS 24 + #define FILE_CONTEXT_SUBS_DIST 25 +-#define NEL 26 ++#define BOOLEAN_SUBS 26 ++#define LXC_CONTEXTS 27 ++#define NEL 28 + + /* Part of one-time lazy init */ + static pthread_once_t once = PTHREAD_ONCE_INIT; +@@ -301,6 +304,29 @@ const char *selinux_binary_policy_path(void) hidden_def(selinux_binary_policy_path) @@ -406,19 +643,47 @@ index f42cb7c..907b004 100644 const char *selinux_file_context_path(void) { return get_path(FILE_CONTEXTS); +@@ -418,6 +444,19 @@ const char *selinux_virtual_image_context_path(void) + + hidden_def(selinux_virtual_image_context_path) + ++const char *selinux_lxc_contexts_path(void) ++{ ++ return get_path(LXC_CONTEXTS); ++} ++ ++hidden_def(selinux_lxc_contexts_path) ++ ++const char * selinux_booleans_subs_path(void) { ++ return get_path(BOOLEAN_SUBS); ++} ++ ++hidden_def(selinux_booleans_subs_path) ++ + const char * selinux_file_context_subs_path(void) { + return get_path(FILE_CONTEXT_SUBS); + } diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h -index 00df405..4db366a 100644 +index 00df405..8a935d0 100644 --- a/libselinux/src/selinux_internal.h +++ b/libselinux/src/selinux_internal.h -@@ -60,6 +60,7 @@ hidden_proto(selinux_mkload_policy) +@@ -60,12 +60,15 @@ hidden_proto(selinux_mkload_policy) hidden_proto(security_setenforce) hidden_proto(security_deny_unknown) hidden_proto(selinux_binary_policy_path) ++ hidden_proto(selinux_booleans_subs_path) + hidden_proto(selinux_current_policy_path) hidden_proto(selinux_default_context_path) hidden_proto(selinux_securetty_types_path) hidden_proto(selinux_failsafe_context_path) -@@ -82,6 +83,7 @@ hidden_proto(selinux_mkload_policy) + hidden_proto(selinux_removable_context_path) + hidden_proto(selinux_virtual_domain_context_path) + hidden_proto(selinux_virtual_image_context_path) ++ hidden_proto(selinux_lxc_contexts_path) + hidden_proto(selinux_file_context_path) + hidden_proto(selinux_file_context_homedir_path) + hidden_proto(selinux_file_context_local_path) +@@ -82,6 +85,7 @@ hidden_proto(selinux_mkload_policy) hidden_proto(selinux_path) hidden_proto(selinux_check_passwd_access) hidden_proto(selinux_check_securetty_context) diff --git a/libselinux.spec b/libselinux.spec index bf4a53a..2bb12fc 100644 --- a/libselinux.spec +++ b/libselinux.spec @@ -8,7 +8,7 @@ Summary: SELinux library and simple utilities Name: libselinux Version: 2.1.10 -Release: 1%{?dist} +Release: 3%{?dist} License: Public Domain Group: System Environment/Libraries Source: %{name}-%{version}.tgz @@ -233,6 +233,12 @@ rm -rf %{buildroot} %{ruby_sitearch}/selinux.so %changelog +* Tue Apr 17 2012 Dan Walsh - 2.1.10-3 +- Add support for lxc contexts file + +* Fri Mar 30 2012 Dan Walsh - 2.1.10-2 +- Add support fot boolean subs file + * Thu Mar 29 2012 Dan Walsh - 2.1.10-1 - Update to upstream * Fix dead links to www.nsa.gov/selinux