libselinux/libselinux-rhat.patch

diff --exclude-from=exclude -N -u -r nsalibselinux/include/selinux/selinux.h libselinux-1.23.2/include/selinux/selinux.h
--- nsalibselinux/include/selinux/selinux.h	2005-03-17 10:34:51.000000000 -0500
+++ libselinux-1.23.2/include/selinux/selinux.h	2005-03-28 15:02:16.000000000 -0500
@@ -136,6 +136,16 @@
 /* Load a policy configuration. */
 extern int security_load_policy(void *data, size_t len);
 
+/* Translate boolean strict to name value pair. */
+typedef struct {
+	char *name;
+	int value; 
+} SELboolean;
+	/* save a list of booleans in a single transaction.  */
+extern int security_set_boolean_list(size_t boolcnt, 
+				     SELboolean *boollist, 
+				     int permanent);
+
 /* Load policy boolean settings.
    Path may be NULL, in which case the booleans are loaded from
    the active policy boolean configuration file. */
diff --exclude-from=exclude -N -u -r nsalibselinux/src/booleans.c libselinux-1.23.2/src/booleans.c
--- nsalibselinux/src/booleans.c	2004-11-09 09:13:54.000000000 -0500
+++ libselinux-1.23.2/src/booleans.c	2005-03-29 10:29:50.000000000 -0500
@@ -238,51 +238,198 @@
 	dest[i+1]='\0';
 	return dest;
 }
+static int process_boolean(char *buffer, char *name, int namesize, int *val) {
+	char name1[BUFSIZ];
+	char *ptr;
+	char *tok=strtok_r(buffer,"=",&ptr);
+	if (tok) {
+		strncpy(name1,tok, BUFSIZ-1);
+		strtrim(name,name1,namesize-1);
+		if ( name[0]=='#' ) return 0;
+		tok=strtok_r(NULL,"\0",&ptr);
+		if (tok) {
+			while (isspace(*tok)) tok++;
+			*val = -1;
+			if (isdigit(tok[0]))
+				*val=atoi(tok);
+			else if (!strncasecmp(tok, "true", sizeof("true")-1))
+				*val = 1;
+			else if (!strncasecmp(tok, "false", sizeof("false")-1))
+				*val = 0;
+			if (*val != 0 && *val != 1) {
+				errno=EINVAL;
+				return -1;
+			}
+			
+		}
+	}
+	return 1;
+}
+static int save_booleans(size_t boolcnt, SELboolean *boollist) {
+	ssize_t len;
+	size_t i;
+	char outbuf[BUFSIZ];
+	char *inbuf=NULL;
+	
+	/* Open file */
+	const char *bool_file = selinux_booleans_path();
+	char local_bool_file[PATH_MAX];
+	char tmp_bool_file[PATH_MAX]; 
+	FILE *boolf;
+	int fd;
+	int *used= (int *) malloc (sizeof(int) * boolcnt);
+	if (! used) {
+		return -1;
+	}
+	/* zero out used field */
+	for (i=0; i < boolcnt; i++)
+		used[i]=0;
+
+
+	snprintf(tmp_bool_file,sizeof(tmp_bool_file),"%s.XXXXXX", bool_file);
+	fd = mkstemp(tmp_bool_file);
+	if (fd < 0) { 
+		free(used);
+		return -1;
+	}
+
+	snprintf(local_bool_file,sizeof(local_bool_file),"%s.local", bool_file);	boolf = fopen(local_bool_file,"r");
+	if (boolf != NULL) {
+		ssize_t ret;
+		size_t size=0;
+		int val;
+		char boolname[BUFSIZ];
+		char *buffer;
+		char *inbuf=NULL;
+		while ((len=getline(&inbuf, &size, boolf)) > 0) {
+			buffer=strdup(inbuf);
+			if (!buffer) goto close_remove_fail;
+			ret=process_boolean(inbuf, boolname, sizeof(boolname), &val);
+			if (ret!=1) { 
+				ret=write(fd, buffer, len);
+				free(buffer);
+				if (ret != len) 
+					goto close_remove_fail;
+			} else {
+				free(buffer);
+				for (i=0; i < boolcnt; i++) {
+					if (strcmp(boollist[i].name, boolname)==0) {
+						snprintf(outbuf,sizeof(outbuf), "%s=%d\n", boolname, boollist[i].value); 
+						len=strlen(outbuf);
+						used[i]=1;
+						if (write(fd, outbuf, len) != len) 
+							goto close_remove_fail;
+						else 
+							break;
+					}
+				}
+				if ( i == boolcnt ) {
+					snprintf(outbuf,sizeof(outbuf), "%s=%d\n", boolname, val); 
+					len=strlen(outbuf);
+					if (write(fd, outbuf, len) != len) 
+						goto close_remove_fail;
+				}
+			}
+			free(inbuf);
+			inbuf=NULL;
+		}
+		fclose(boolf);
+	}
+	
+	for (i=0; i < boolcnt; i++) {
+		if (used[i]==0) {
+			snprintf(outbuf,sizeof(outbuf), "%s=%d\n", boollist[i].name, boollist[i].value); 
+			len=strlen(outbuf);
+			if (write(fd, outbuf, len) != len) {
+			close_remove_fail:
+				free(inbuf);
+				close(fd);
+			remove_fail:
+				unlink(tmp_bool_file);
+				free(used);
+				return -1;
+			}
+		}
+		
+	}
+	if (fchmod(fd, S_IRUSR | S_IWUSR) != 0)
+		goto close_remove_fail;
+	close(fd);
+	if (rename(tmp_bool_file, local_bool_file) != 0)
+		goto remove_fail;
+
+	free(used);
+	return 0;
+}
+static void rollback(SELboolean *boollist, int end)
+{
+	int i;
+
+        for(i=0; i<end; i++)
+                security_set_boolean(boollist[i].name,
+                        security_get_boolean_active(boollist[i].name));
+}
+
+
+int security_set_boolean_list(size_t boolcnt, SELboolean *boollist, int permanent) {
+
+	size_t i;
+	for (i=0; i < boolcnt; i++) {
+		if(security_set_boolean(boollist[i].name, boollist[i].value)) {
+			rollback(boollist, i);
+			return -1;
+		}
+	}
 
+	/* OK, let's do the commit */
+	if (security_commit_booleans()) {
+		return -1;
+	}
+
+	if (permanent) 
+		return save_booleans(boolcnt, boollist);
+
+	return 0;
+}
 int security_load_booleans(char *path) {
 	FILE *boolf;
-	char buffer[BUFSIZ];
-	char name[BUFSIZ];
-	char name1[BUFSIZ];
+	char *inbuf;
+	char localbools[BUFSIZ];
+	size_t len=0, errors=0;
 	int val;
-	int errors=0;
+	char name[BUFSIZ];
 
 	boolf = fopen(path ? path : selinux_booleans_path(),"r");
 	if (boolf == NULL) 
 		return -1;
 
-        while (fgets_unlocked(buffer, sizeof(buffer), boolf)) {
-		char *ptr;
-		char *tok=strtok_r(buffer,"=",&ptr);
-		if (tok) {
-			strncpy(name1,tok, BUFSIZ-1);
-			strtrim(name,name1,BUFSIZ-1);
-			if ( name[0]=='#' ) continue;
-			tok=strtok_r(NULL,"\0",&ptr);
-			if (tok) {
-				while (isspace(*tok)) tok++;
-				val = -1;
-				if (isdigit(tok[0]))
-					val=atoi(tok);
-				else if (!strncmp(tok, "true", sizeof("true")-1))
-					val = 1;
-				else if (!strncmp(tok, "false", sizeof("false")-1))
-					val = 0;
-				if (val != 0 && val != 1) {
-					fprintf(stderr,"illegal value for boolean %s=%s\n", name, tok);
-					errors++;
-					continue;
-				}
+	while (getline(&inbuf, &len, boolf) > 0) {
+		int ret=process_boolean(inbuf, name, sizeof(name), &val);
+		if (ret==-1) 
+			errors++;
+		if (ret==1) 
+			if (security_set_boolean(name, val) < 0) {
+				errors++;
+			}
+	}
+	fclose(boolf);
+
+	snprintf(localbools,sizeof(localbools), "%s.local", (path ? path : selinux_booleans_path()));
+	boolf = fopen(localbools,"r");
 
+	if (boolf != NULL) {
+		int ret;
+		while (getline(&inbuf, &len, boolf) > 0) {
+			ret=process_boolean(inbuf, name, sizeof(name), &val);
+			if (ret==-1) 
+				errors++;
+			if (ret==1) 
 				if (security_set_boolean(name, val) < 0) {
-					fprintf(stderr,"error setting boolean %s to value %d \n", name, val);
 					errors++;
 				}
-			}
 		}
+		fclose(boolf);
 	}
-	fclose(boolf);
-
 	if (security_commit_booleans() < 0)
 		return -1;
 
diff --exclude-from=exclude -N -u -r nsalibselinux/src/matchmediacon.c libselinux-1.23.2/src/matchmediacon.c
--- nsalibselinux/src/matchmediacon.c	2004-10-20 16:31:36.000000000 -0400
+++ libselinux-1.23.2/src/matchmediacon.c	2005-03-28 16:44:29.000000000 -0500
@@ -16,7 +16,7 @@
 {
 	const char *path = selinux_media_context_path();
 	FILE *infile;
-	char *ptr, *ptr2;
+	char *ptr, *ptr2=NULL;
 	int found=-1;
 	char current_line[PATH_MAX];
 	if ((infile = fopen(path, "r")) == NULL)
diff --exclude-from=exclude -N -u -r nsalibselinux/src/matchpathcon.c libselinux-1.23.2/src/matchpathcon.c
--- nsalibselinux/src/matchpathcon.c	2005-03-17 10:34:51.000000000 -0500
+++ libselinux-1.23.2/src/matchpathcon.c	2005-03-28 16:45:06.000000000 -0500
@@ -531,7 +531,7 @@
 	char *line_buf = NULL;
 	size_t line_len = 0;
 	unsigned int lineno, pass, i, j, maxnspec;
-	spec_t *spec_copy;
+	spec_t *spec_copy=NULL;
 	int status=-1;
 
 	/* Open the specification file. */
diff --exclude-from=exclude -N -u -r nsalibselinux/utils/setenforce.c libselinux-1.23.2/utils/setenforce.c
--- nsalibselinux/utils/setenforce.c	2005-01-20 16:05:25.000000000 -0500
+++ libselinux-1.23.2/utils/setenforce.c	2005-03-28 14:47:58.000000000 -0500
@@ -13,7 +13,7 @@
 
 int main(int argc, char **argv) 
 {
-	int rc;
+	int rc=0;
 	if (argc != 2) {
 		usage(argv[0]);
 	}
diff --exclude-from=exclude -N -u -r nsalibselinux/utils/setsebool.c libselinux-1.23.2/utils/setsebool.c
--- nsalibselinux/utils/setsebool.c	2005-02-22 16:34:17.000000000 -0500
+++ libselinux-1.23.2/utils/setsebool.c	2005-03-28 16:45:42.000000000 -0500
@@ -8,11 +8,11 @@
 #include <syslog.h>
 #include <pwd.h>
 #include <selinux/selinux.h>
+#include <errno.h>
 
 int permanent = 0;
 
-int setbool(char **list, int start, int end);
-void rollback(char *list[], int start, int end);
+int setbool(char **list, size_t start, size_t end);
 
 
 void usage(void)
@@ -23,7 +23,7 @@
 
 int main(int argc, char **argv)
 {
-	int rc, start;
+	size_t rc, start;
 
 	if (argc < 2) 
 		usage();
@@ -72,12 +72,20 @@
 
 /* Given an array of strings in the form "boolname=value", a start index,
    and a finish index...walk the list and set the bool. */
-int setbool(char **list, int start, int end)
+int setbool(char **list, size_t start, size_t end)
 {
 	char *name, *value_ptr;
 	int i=start, value;
+	int ret=0;
+	int j=0;
+	size_t boolcnt=end-start;
 	struct passwd *pwd;
-
+	SELboolean *vallist=calloc(boolcnt, sizeof(SELboolean));
+	if (!vallist) {
+		fprintf(stderr, 
+			"Error setting booleans: %s\n", strerror(errno));
+		return 1;
+	}
 	while (i < end) {
 		name = list[i];
 		value_ptr = strchr(list[i], '=');
@@ -85,8 +93,8 @@
 			fprintf(stderr, 
 			"setsebool: '=' not found in boolean expression %s\n",
 				list[i]);
-			rollback(list, start, i);
-			return 4;
+			ret=4;
+			goto error_label;
 		}
 		*value_ptr = 0;
 		value_ptr++;
@@ -99,92 +107,43 @@
 		else {
 			fprintf(stderr, "setsebool: illegal boolean value %s\n",
 				value_ptr);
-			rollback(list, start, i);
-			return 1;
+			ret=1;
+			goto error_label;
 		}
 
-		if(security_set_boolean(name, value)) {
+		vallist[j].value = value;
+		vallist[j].name = strdup(name);
+		if (!vallist[j].name) {
 			fprintf(stderr, 
 				"Error setting boolean %s to value %d (%s)\n", 
 				name, value, strerror(errno));
-			rollback(list, start, i);
-			return 2;
+			ret= 2;
+			goto error_label;
 		}
 		i++;
+		j++;
 
 		/* Now put it back */
 		value_ptr--;
 		*value_ptr = '=';
 	}
 
-	/* At this point we know that everything is good. Let's write
-	   the file if the -P option was given. */
-	if (permanent) {
-		char **names;
-		const char *bool_file;
-		char *tmp_bool_file;
-		int rc, len, fd, j;
-
-		rc = security_get_boolean_names(&names, &len);
-		if (rc) {
-			fprintf(stderr,
-				"Unable to get boolean names:  %s\n",
-				strerror(errno));
-			rollback(list, start, i);
-			return 5;
-		}
+	ret=security_set_boolean_list(boolcnt, vallist, permanent);
 
-		if (!len) {
-			fprintf(stderr, 
-			"Unable to get the boolean list from kernel - exiting\n"
-				);
-			rollback(list, start, i);
-			return 6;
-		}
+ error_label:
+	for (i=0; i < boolcnt; i++) 
+		if (vallist[i].name) free(vallist[i].name);
+	free(vallist);
 
-		/* Open file */
-		bool_file = selinux_booleans_path();
-		tmp_bool_file = (char *) alloca (strlen(bool_file) + 8);
-		strcpy(stpcpy(tmp_bool_file, bool_file), ".XXXXXX");
-		fd = mkstemp(tmp_bool_file);
-		if (fd < 0) {
+	if (ret) {
+		if (errno==ENOENT) {
 			fprintf(stderr, 
-				"Error creating boolean file %s\n", 
-				bool_file);
-			rollback(list, start, i);
-			return 7;
-			
+				"Error setting boolean: Invalid boolean\n");
+		} else {
+			if (errno) 
+				perror("Error setting booleans");
 		}
-
-		/* Walk the list in pending memory, writing each to the file */
-		for (j=0; j<len; j++) {
-			char val_str[72];
-			int len;
-			int pending = security_get_boolean_pending(names[j]);
-			len = snprintf(val_str, sizeof(val_str), "%s=%d\n", 
-							names[j], pending);
-			if (write(fd, val_str, len) != len) {
-			close_remove_fail:
-				close(fd);
-			remove_fail:
-				unlink(tmp_bool_file);
-				rollback(list, start, i);
-				return 8;
-			}
-		}
-
-		if (fchmod(fd, S_IRUSR | S_IWUSR) != 0)
-			goto close_remove_fail;
-		close(fd);
-		if (rename(tmp_bool_file, bool_file) != 0)
-			goto remove_fail;
-		syslog(LOG_NOTICE, "%s has been updated.", bool_file);
-	}
-	
-	/* OK, let's do the commit */
-	if (security_commit_booleans()) {
-		fputs("Error committing booleans\n", stderr);
-		return 3;
+		return ret;
 	}
 
 	/* Now log what was done */
@@ -211,12 +170,3 @@
 	return 0;
 }
 
-void rollback(char *list[], int start, int end)
-{
-	int i;
-
-        for(i=start; i<end; i++)
-                security_set_boolean(list[i],
-                        security_get_boolean_active(list[i]));
-}
-