diff --exclude-from=exclude -N -u -r nsalibselinux/ChangeLog libselinux-2.0.70/ChangeLog --- nsalibselinux/ChangeLog 2008-08-01 06:48:06.000000000 -0400 +++ libselinux-2.0.70/ChangeLog 2008-08-01 06:51:25.000000000 -0400 @@ -1,6 +1,3 @@ -2.0.70 2008-07-30 - * Merge ruby bindings from Dan Walsh. - 2.0.69 2008-07-29 * Handle duplicate file context regexes as a fatal error from Stephen Smalley. This prevents adding them via semanage. diff --exclude-from=exclude -N -u -r nsalibselinux/VERSION libselinux-2.0.70/VERSION --- nsalibselinux/VERSION 2008-08-01 06:48:06.000000000 -0400 +++ libselinux-2.0.70/VERSION 2008-08-01 06:51:25.000000000 -0400 @@ -1 +1 @@ -2.0.70 +2.0.69 diff --exclude-from=exclude -N -u -r nsalibselinux/man/man8/selinuxconlist.8 libselinux-2.0.70/man/man8/selinuxconlist.8 --- nsalibselinux/man/man8/selinuxconlist.8 1969-12-31 19:00:00.000000000 -0500 +++ libselinux-2.0.70/man/man8/selinuxconlist.8 2008-08-01 06:51:25.000000000 -0400 @@ -0,0 +1,18 @@ +.TH "selinuxconlist" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation" +.SH "NAME" +selinuxconlist \- list all SELinux context reachable for user +.SH "SYNOPSIS" +.B selinuxconlist [-l level] user [context] + +.SH "DESCRIPTION" +.B selinuxconlist +reports the list of context reachable for user from the current context or specified context + +.B \-l level +mcs/mls level + +.SH AUTHOR +This manual page was written by Dan Walsh . + +.SH "SEE ALSO" +secon(8), selinuxdefcon(8) diff --exclude-from=exclude -N -u -r nsalibselinux/man/man8/selinuxdefcon.8 libselinux-2.0.70/man/man8/selinuxdefcon.8 --- nsalibselinux/man/man8/selinuxdefcon.8 1969-12-31 19:00:00.000000000 -0500 +++ libselinux-2.0.70/man/man8/selinuxdefcon.8 2008-08-01 06:51:25.000000000 -0400 @@ -0,0 +1,19 @@ +.TH "selinuxdefcon" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation" +.SH "NAME" +selinuxdefcon \- list default SELinux context for user + +.SH "SYNOPSIS" +.B selinuxdefcon [-l level] user [fromcon] + +.SH "DESCRIPTION" +.B seconlist +reports the default context for the specified user from current context or specified context + +.B \-l level +mcs/mls level + +.SH AUTHOR +This manual page was written by Dan Walsh . + +.SH "SEE ALSO" +secon(8), selinuxconlist(8) diff --exclude-from=exclude -N -u -r nsalibselinux/src/callbacks.c libselinux-2.0.70/src/callbacks.c --- nsalibselinux/src/callbacks.c 2008-06-12 23:25:14.000000000 -0400 +++ libselinux-2.0.70/src/callbacks.c 2008-08-01 06:51:25.000000000 -0400 @@ -16,6 +16,7 @@ { int rc; va_list ap; + if (is_selinux_enabled() == 0) return 0; va_start(ap, fmt); rc = vfprintf(stderr, fmt, ap); va_end(ap); diff --exclude-from=exclude -N -u -r nsalibselinux/src/matchpathcon.c libselinux-2.0.70/src/matchpathcon.c --- nsalibselinux/src/matchpathcon.c 2008-06-12 23:25:14.000000000 -0400 +++ libselinux-2.0.70/src/matchpathcon.c 2008-08-01 06:51:25.000000000 -0400 @@ -2,6 +2,7 @@ #include #include #include +#include #include "selinux_internal.h" #include "label_internal.h" #include "callbacks.h" @@ -57,7 +58,7 @@ { va_list ap; va_start(ap, fmt); - vfprintf(stderr, fmt, ap); + vsyslog(LOG_ERR, fmt, ap); va_end(ap); } diff --exclude-from=exclude -N -u -r nsalibselinux/src/seusers.c libselinux-2.0.70/src/seusers.c --- nsalibselinux/src/seusers.c 2008-06-12 23:25:14.000000000 -0400 +++ libselinux-2.0.70/src/seusers.c 2008-08-01 06:53:03.000000000 -0400 @@ -89,6 +89,62 @@ int require_seusers hidden = 0; +#include +#include + +static gid_t get_default_gid(const char *name) { + struct passwd pwstorage, *pwent = NULL; + gid_t gid = -1; + /* Allocate space for the getpwnam_r buffer */ + long rbuflen = sysconf(_SC_GETPW_R_SIZE_MAX); + if (rbuflen <= 0) return -1; + char *rbuf = malloc(rbuflen); + if (rbuf == NULL) return -1; + + int retval = getpwnam_r(name, &pwstorage, rbuf, rbuflen, &pwent); + if (retval == 0 || pwent != NULL) { + gid = pwent->pw_gid; + } + free(rbuf); + return gid; +} + +static int check_group(const char *group, const char *name, const gid_t gid) { + int match = 0; + int i, ng = 0; + gid_t *groups = NULL; + struct group gbuf, *grent = NULL; + + long rbuflen = sysconf(_SC_GETGR_R_SIZE_MAX); + if (rbuflen <= 0) + return 0; + char *rbuf = malloc(rbuflen); + if (rbuf == NULL) + return 0; + + if (getgrnam_r(group, &gbuf, rbuf, rbuflen, + &grent) != 0) + goto done; + + if (getgrouplist(name, gid, NULL, &ng) < 0) { + groups = (gid_t *) malloc(sizeof (gid_t) * ng); + if (!groups) goto done; + if (getgrouplist(name, gid, groups, &ng) < 0) goto done; + } + + for (i = 0; i < ng; i++) { + if (grent->gr_gid == groups[i]) { + match = 1; + goto done; + } + } + + done: + free(groups); + free(rbuf); + return match; +} + int getseuserbyname(const char *name, char **r_seuser, char **r_level) { FILE *cfg = NULL; @@ -101,9 +157,14 @@ char *username = NULL; char *seuser = NULL; char *level = NULL; + char *groupseuser = NULL; + char *grouplevel = NULL; char *defaultseuser = NULL; char *defaultlevel = NULL; + gid_t gid = get_default_gid(name); + if ( gid == (gid_t) -1 ) goto nomatch; + cfg = fopen(selinux_usersconf_path(), "r"); if (!cfg) goto nomatch; @@ -124,31 +185,48 @@ if (!strcmp(username, name)) break; - if (!defaultseuser && !strcmp(username, "__default__")) { - free(username); - defaultseuser = seuser; - defaultlevel = level; + if (username[0] == '%' && + !groupseuser && + check_group(&username[1], name, gid)) { + groupseuser = seuser; + grouplevel = level; } else { - free(username); - free(seuser); - free(level); + if (!defaultseuser && + !strcmp(username, "__default__")) { + defaultseuser = seuser; + defaultlevel = level; + } else { + free(seuser); + free(level); + } } + free(username); + username = NULL; seuser = NULL; } - if (buffer) - free(buffer); + free(buffer); fclose(cfg); if (seuser) { free(username); free(defaultseuser); free(defaultlevel); + free(groupseuser); + free(grouplevel); *r_seuser = seuser; *r_level = level; return 0; } + if (groupseuser) { + free(defaultseuser); + free(defaultlevel); + *r_seuser = groupseuser; + *r_level = grouplevel; + return 0; + } + if (defaultseuser) { *r_seuser = defaultseuser; *r_level = defaultlevel;