rpms/libselinux
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add support for lxc contexts file

Browse Source
This commit is contained in:
Dan Walsh 2012-04-19 16:34:27 -04:00
parent 884d86db59
commit 40eaa6c970
2 changed files with 278 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

277
libselinux-rhat.patch
View File

@ -15,7 +15,7 @@ index 1a54307..f6eeb21 100644
/*
* Label operations
diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
index 6f483c9..fbcd3ac 100644
index 6f483c9..9756ac9 100644
--- a/libselinux/include/selinux/selinux.h
+++ b/libselinux/include/selinux/selinux.h
@@ -139,7 +139,10 @@ struct av_decision {
@ -50,6 +50,19 @@ index 6f483c9..fbcd3ac 100644
extern const char *selinux_binary_policy_path(void);
extern const char *selinux_failsafe_context_path(void);
extern const char *selinux_removable_context_path(void);
@@ -502,10 +511,12 @@ extern const char *selinux_homedir_context_path(void);
extern const char *selinux_media_context_path(void);
extern const char *selinux_virtual_domain_context_path(void);
extern const char *selinux_virtual_image_context_path(void);
+extern const char *selinux_lxc_contexts_path(void);
extern const char *selinux_x_context_path(void);
extern const char *selinux_sepgsql_context_path(void);
extern const char *selinux_contexts_path(void);
extern const char *selinux_securetty_types_path(void);
+extern const char *selinux_booleans_subs_path(void);
extern const char *selinux_booleans_path(void);
extern const char *selinux_customizable_types_path(void);
extern const char *selinux_users_path(void);
diff --git a/libselinux/man/man3/matchpathcon.3 b/libselinux/man/man3/matchpathcon.3
index cdbb252..b6814ed 100644
--- a/libselinux/man/man3/matchpathcon.3
@ -196,6 +209,206 @@ index be4c0a3..a07aa7f 100644
if (rc == 0 && !blocking) {
errno = EWOULDBLOCK;
diff --git a/libselinux/src/booleans.c b/libselinux/src/booleans.c
index 1510043..bf526c0 100644
--- a/libselinux/src/booleans.c
+++ b/libselinux/src/booleans.c
@@ -86,45 +86,131 @@ int security_get_boolean_names(char ***names, int *len)
}
hidden_def(security_get_boolean_names)
-#define STRBUF_SIZE 3
-static int get_bool_value(const char *name, char **buf)
+
+static char * bool_sub(const char *name)
{
- int fd, len;
+ char *sub = NULL;
+ char *line_buf = NULL;
+ size_t line_len = 0;
+ FILE *cfg;
+
+ if (!name)
+ return NULL;
+
+ cfg = fopen(selinux_booleans_subs_path(), "r");
+
+ if (!cfg)
+ return NULL;
+
+ while (getline(&line_buf, &line_len, cfg)) {
+ char *ptr = NULL;
+ char *src = line_buf;
+ char *dst = NULL;
+
+ while (*src && isspace(*src))
+ src++;
+ if (src[0] == '#') continue;
+ ptr = src;
+ while (*ptr && ! isspace(*ptr))
+ ptr++;
+ *ptr++ = '\0';
+ if (! *src || (strcmp(src, name) != 0))
+ continue;
+
+ dst = ptr;
+ while (*dst && isspace(*dst))
+ dst++;
+ ptr=dst;
+ while (*ptr && ! isspace(*ptr))
+ ptr++;
+ *ptr='\0';
+ if (! *dst)
+ continue;
+
+ sub = strdup(dst);
+ break;
+ }
+
+ free(line_buf);
+ fclose(cfg);
+ return sub;
+}
+
+static int bool_open(const char *name, int flag) {
char *fname = NULL;
+ char *alt_name = NULL;
+ int len;
+ int fd = -1;
+ char *ptr;
- if (!selinux_mnt) {
- errno = ENOENT;
- return -1;
+ if (!name) {
+ errno = EINVAL;
+ return fd;
}
- *buf = (char *)malloc(sizeof(char) * (STRBUF_SIZE + 1));
- if (!*buf)
- goto out;
- (*buf)[STRBUF_SIZE] = 0;
-
len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
fname = (char *)malloc(sizeof(char) * len);
if (!fname)
- goto out;
+ return fd;
+
snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name);
- fd = open(fname, O_RDONLY);
- if (fd < 0)
+ fd = open(fname, flag);
+ if (fd >= 0 || errno != ENOENT)
goto out;
- len = read(fd, *buf, STRBUF_SIZE);
- close(fd);
- if (len != STRBUF_SIZE)
+ alt_name = bool_sub(name);
+ if (! alt_name)
goto out;
+ len = strlen(alt_name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
+ ptr = realloc(fname, len);
+ if (!ptr)
+ goto out;
+
+ fname = ptr;
+ snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, alt_name);
+ fd = open(fname, flag);
+
+out:
free(fname);
- return 0;
+ free(alt_name);
+
+ return fd;
+}
+
+#define STRBUF_SIZE 3
+static int get_bool_value(const char *name, char **buf)
+{
+ int fd, len;
+ int rc = -1;
+ char *bool_buf = NULL;
+ if (!selinux_mnt) {
+ errno = ENOENT;
+ return -1;
+ }
+
+ fd = bool_open(name, O_RDONLY);
+ if (fd < 0)
+ return -1;
+
+ bool_buf = malloc(sizeof(char) * (STRBUF_SIZE + 1));
+ if (!bool_buf)
+ goto out;
+ bool_buf[STRBUF_SIZE] = 0;
+
+ len = read(fd, bool_buf, STRBUF_SIZE);
+ if (len != STRBUF_SIZE)
+ goto out;
+ rc = 0;
out:
- if (*buf)
- free(*buf);
- if (fname)
- free(fname);
- return -1;
+ close(fd);
+ if (!rc) {
+ *buf = bool_buf;
+ } else {
+ free(bool_buf);
+ }
+ return rc;
}
int security_get_boolean_pending(const char *name)
@@ -164,8 +250,8 @@ hidden_def(security_get_boolean_active)
int security_set_boolean(const char *name, int value)
{
- int fd, ret, len;
- char buf[2], *fname;
+ int fd, ret;
+ char buf[2];
if (!selinux_mnt) {
errno = ENOENT;
@@ -176,17 +262,9 @@ int security_set_boolean(const char *name, int value)
return -1;
}
- len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
- fname = (char *)malloc(sizeof(char) * len);
- if (!fname)
+ fd = bool_open(name, O_WRONLY);
+ if (fd < 0)
return -1;
- snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name);
-
- fd = open(fname, O_WRONLY);
- if (fd < 0) {
- ret = -1;
- goto out;
- }
if (value)
buf[0] = '1';
@@ -196,8 +274,7 @@ int security_set_boolean(const char *name, int value)
ret = write(fd, buf, 2);
close(fd);
- out:
- free(fname);
+
if (ret > 0)
return 0;
else
diff --git a/libselinux/src/callbacks.c b/libselinux/src/callbacks.c
index b245364..7c47222 100644
--- a/libselinux/src/callbacks.c
@ -208,6 +421,19 @@ index b245364..7c47222 100644
va_start(ap, fmt);
rc = vfprintf(stderr, fmt, ap);
va_end(ap);
diff --git a/libselinux/src/file_path_suffixes.h b/libselinux/src/file_path_suffixes.h
index 0b00156..825f295 100644
--- a/libselinux/src/file_path_suffixes.h
+++ b/libselinux/src/file_path_suffixes.h
@@ -22,6 +22,8 @@ S_(BINPOLICY, "/policy/policy")
S_(COLORS, "/secolor.conf")
S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context")
S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context")
+ S_(LXC_CONTEXTS, "/contexts/lxc_contexts")
S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs")
S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist")
S_(SEPGSQL_CONTEXTS, "/contexts/sepgsql_contexts")
+ S_(BOOLEAN_SUBS, "/booleans.subs")
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index 7bc46cc..82a608c 100644
--- a/libselinux/src/label_file.c
@ -365,7 +591,7 @@ index 8f200d4..c18ea47 100644
int matchpathcon_init(const char *path)
diff --git a/libselinux/src/selinux_config.c b/libselinux/src/selinux_config.c
index f42cb7c..907b004 100644
index f42cb7c..f544ac2 100644
--- a/libselinux/src/selinux_config.c
+++ b/libselinux/src/selinux_config.c
@@ -9,6 +9,7 @@
@ -376,7 +602,18 @@ index f42cb7c..907b004 100644
#include "get_default_type_internal.h"
#define SELINUXDIR "/etc/selinux/"
@@ -301,6 +302,29 @@ const char *selinux_binary_policy_path(void)
@@ -46,7 +47,9 @@
#define FILE_CONTEXT_SUBS 23
#define SEPGSQL_CONTEXTS 24
#define FILE_CONTEXT_SUBS_DIST 25
-#define NEL 26
+#define BOOLEAN_SUBS 26
+#define LXC_CONTEXTS 27
+#define NEL 28
/* Part of one-time lazy init */
static pthread_once_t once = PTHREAD_ONCE_INIT;
@@ -301,6 +304,29 @@ const char *selinux_binary_policy_path(void)
hidden_def(selinux_binary_policy_path)
@ -406,19 +643,47 @@ index f42cb7c..907b004 100644
const char *selinux_file_context_path(void)
{
return get_path(FILE_CONTEXTS);
@@ -418,6 +444,19 @@ const char *selinux_virtual_image_context_path(void)
hidden_def(selinux_virtual_image_context_path)
+const char *selinux_lxc_contexts_path(void)
+{
+ return get_path(LXC_CONTEXTS);
+}
+
+hidden_def(selinux_lxc_contexts_path)
+
+const char * selinux_booleans_subs_path(void) {
+ return get_path(BOOLEAN_SUBS);
+}
+
+hidden_def(selinux_booleans_subs_path)
+
const char * selinux_file_context_subs_path(void) {
return get_path(FILE_CONTEXT_SUBS);
}
diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h
index 00df405..4db366a 100644
index 00df405..8a935d0 100644
--- a/libselinux/src/selinux_internal.h
+++ b/libselinux/src/selinux_internal.h
@@ -60,6 +60,7 @@ hidden_proto(selinux_mkload_policy)
@@ -60,12 +60,15 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(security_setenforce)
hidden_proto(security_deny_unknown)
hidden_proto(selinux_binary_policy_path)
+ hidden_proto(selinux_booleans_subs_path)
+ hidden_proto(selinux_current_policy_path)
hidden_proto(selinux_default_context_path)
hidden_proto(selinux_securetty_types_path)
hidden_proto(selinux_failsafe_context_path)
@@ -82,6 +83,7 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(selinux_removable_context_path)
hidden_proto(selinux_virtual_domain_context_path)
hidden_proto(selinux_virtual_image_context_path)
+ hidden_proto(selinux_lxc_contexts_path)
hidden_proto(selinux_file_context_path)
hidden_proto(selinux_file_context_homedir_path)
hidden_proto(selinux_file_context_local_path)
@@ -82,6 +85,7 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(selinux_path)
hidden_proto(selinux_check_passwd_access)
hidden_proto(selinux_check_securetty_context)

8
libselinux.spec
View File

@ -8,7 +8,7 @@
Summary: SELinux library and simple utilities
Name: libselinux
Version: 2.1.10
Release: 1%{?dist}
Release: 3%{?dist}
License: Public Domain
Group: System Environment/Libraries
Source: %{name}-%{version}.tgz
@ -233,6 +233,12 @@ rm -rf %{buildroot}
%{ruby_sitearch}/selinux.so
%changelog
* Tue Apr 17 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.10-3
- Add support for lxc contexts file
* Fri Mar 30 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.10-2
- Add support fot boolean subs file
* Thu Mar 29 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
- Update to upstream
* Fix dead links to www.nsa.gov/selinux