2011-12-07 11:35:26 +00:00
|
|
|
diff -up net-tools-1.60/config.in.selinux net-tools-1.60/config.in
|
2012-01-05 12:41:31 +00:00
|
|
|
--- net-tools-1.60/config.in.selinux 2012-01-05 12:22:43.000000000 +0100
|
|
|
|
+++ net-tools-1.60/config.in 2012-01-05 13:04:45.359263680 +0100
|
|
|
|
@@ -92,3 +92,4 @@ bool 'InfiniBand hardware support' HAVE_
|
2011-12-07 11:35:26 +00:00
|
|
|
bool 'IP Masquerading support' HAVE_FW_MASQUERADE y
|
|
|
|
bool 'Build iptunnel and ipmaddr' HAVE_IP_TOOLS y
|
|
|
|
bool 'Build mii-tool' HAVE_MII y
|
|
|
|
+bool 'SELinux support' HAVE_SELINUX n
|
2011-12-06 18:15:09 +00:00
|
|
|
diff -up net-tools-1.60/Makefile.selinux net-tools-1.60/Makefile
|
2012-01-05 12:41:31 +00:00
|
|
|
--- net-tools-1.60/Makefile.selinux 2012-01-05 12:22:43.000000000 +0100
|
|
|
|
+++ net-tools-1.60/Makefile 2012-01-05 13:04:45.359263680 +0100
|
2011-12-06 18:15:09 +00:00
|
|
|
@@ -114,6 +114,12 @@ endif
|
2006-01-17 10:27:02 +00:00
|
|
|
|
|
|
|
NET_LIB = $(NET_LIB_PATH)/lib$(NET_LIB_NAME).a
|
|
|
|
|
|
|
|
+ifeq ($(HAVE_SELINUX),1)
|
|
|
|
+LDFLAGS += -lselinux
|
|
|
|
+CFLAGS += -DHAVE_SELINUX
|
|
|
|
+else
|
|
|
|
+endif
|
|
|
|
+
|
2011-12-06 18:15:09 +00:00
|
|
|
CPPFLAGS += -I. -I$(TOPDIR)/include -I$(NET_LIB_PATH)
|
|
|
|
LDFLAGS += -L$(NET_LIB_PATH)
|
2006-01-17 10:27:02 +00:00
|
|
|
|
2011-12-06 18:15:09 +00:00
|
|
|
diff -up net-tools-1.60/netstat.c.selinux net-tools-1.60/netstat.c
|
2012-01-05 12:41:31 +00:00
|
|
|
--- net-tools-1.60/netstat.c.selinux 2012-01-05 13:04:45.315264230 +0100
|
|
|
|
+++ net-tools-1.60/netstat.c 2012-01-05 13:05:42.368550965 +0100
|
2011-12-06 18:15:09 +00:00
|
|
|
@@ -89,6 +89,11 @@
|
2006-01-17 10:27:02 +00:00
|
|
|
#include <net/if.h>
|
|
|
|
#include <dirent.h>
|
|
|
|
|
|
|
|
+#if HAVE_SELINUX
|
|
|
|
+#include <selinux/selinux.h>
|
|
|
|
+#else
|
|
|
|
+#define security_context_t char*
|
|
|
|
+#endif
|
|
|
|
#include "net-support.h"
|
|
|
|
#include "pathnames.h"
|
|
|
|
#include "version.h"
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -104,6 +109,7 @@
|
|
|
|
#endif
|
2006-01-17 10:27:02 +00:00
|
|
|
|
|
|
|
#define PROGNAME_WIDTH 20
|
|
|
|
+#define SELINUX_WIDTH 50
|
|
|
|
|
|
|
|
#if !defined(s6_addr32) && defined(in6a_words)
|
|
|
|
#define s6_addr32 in6a_words /* libinet6 */
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -165,6 +171,7 @@ int flag_arg = 0;
|
2006-01-17 10:27:02 +00:00
|
|
|
int flag_ver = 0;
|
2012-01-05 12:41:31 +00:00
|
|
|
int flag_l2cap = 0;
|
|
|
|
int flag_rfcomm = 0;
|
2006-01-17 10:27:02 +00:00
|
|
|
+int flag_selinux = 0;
|
|
|
|
|
|
|
|
FILE *procinfo;
|
|
|
|
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -228,12 +235,17 @@ FILE *procinfo;
|
2006-01-17 10:27:02 +00:00
|
|
|
#define PROGNAME_WIDTH1(s) PROGNAME_WIDTH2(s)
|
|
|
|
#define PROGNAME_WIDTH2(s) #s
|
|
|
|
|
|
|
|
+#define SELINUX_WIDTHs SELINUX_WIDTH1(SELINUX_WIDTH)
|
|
|
|
+#define SELINUX_WIDTH1(s) SELINUX_WIDTH2(s)
|
|
|
|
+#define SELINUX_WIDTH2(s) #s
|
|
|
|
+
|
|
|
|
#define PRG_HASH_SIZE 211
|
|
|
|
|
|
|
|
static struct prg_node {
|
|
|
|
struct prg_node *next;
|
2011-12-06 18:15:09 +00:00
|
|
|
unsigned long inode;
|
2006-01-17 10:27:02 +00:00
|
|
|
char name[PROGNAME_WIDTH];
|
|
|
|
+ char scon[SELINUX_WIDTH];
|
|
|
|
} *prg_hash[PRG_HASH_SIZE];
|
|
|
|
|
|
|
|
static char prg_cache_loaded = 0;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -241,9 +253,12 @@ static char prg_cache_loaded = 0;
|
2006-01-17 10:27:02 +00:00
|
|
|
#define PRG_HASHIT(x) ((x) % PRG_HASH_SIZE)
|
|
|
|
|
|
|
|
#define PROGNAME_BANNER "PID/Program name"
|
|
|
|
+#define SELINUX_BANNER "Security Context"
|
|
|
|
|
2011-12-06 18:15:09 +00:00
|
|
|
#define print_progname_banner() do { if (flag_prg) printf(" %-" PROGNAME_WIDTHs "s",PROGNAME_BANNER); } while (0)
|
2006-01-17 10:27:02 +00:00
|
|
|
|
|
|
|
+#define print_selinux_banner() do { if (flag_selinux) printf("%-" SELINUX_WIDTHs "s"," " SELINUX_BANNER); } while (0)
|
|
|
|
+
|
|
|
|
#define PRG_LOCAL_ADDRESS "local_address"
|
|
|
|
#define PRG_INODE "inode"
|
|
|
|
#define PRG_SOCKET_PFX "socket:["
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -263,7 +278,7 @@ static char prg_cache_loaded = 0;
|
2011-12-06 18:15:09 +00:00
|
|
|
#define PATH_CMDLINE "cmdline"
|
|
|
|
#define PATH_CMDLINEl strlen(PATH_CMDLINE)
|
2006-01-17 10:27:02 +00:00
|
|
|
|
2011-12-06 18:15:09 +00:00
|
|
|
-static void prg_cache_add(unsigned long inode, char *name)
|
|
|
|
+static void prg_cache_add(unsigned long inode, char *name, char *scon)
|
2006-01-17 10:27:02 +00:00
|
|
|
{
|
|
|
|
unsigned hi = PRG_HASHIT(inode);
|
|
|
|
struct prg_node **pnp,*pn;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -284,6 +299,14 @@ static void prg_cache_add(unsigned long
|
2006-01-17 10:27:02 +00:00
|
|
|
if (strlen(name)>sizeof(pn->name)-1)
|
|
|
|
name[sizeof(pn->name)-1]='\0';
|
|
|
|
strcpy(pn->name,name);
|
|
|
|
+
|
|
|
|
+ {
|
|
|
|
+ int len=(strlen(scon)-sizeof(pn->scon))+1;
|
|
|
|
+ if (len > 0)
|
|
|
|
+ strcpy(pn->scon,&scon[len+1]);
|
|
|
|
+ else
|
|
|
|
+ strcpy(pn->scon,scon);
|
|
|
|
+ }
|
|
|
|
}
|
|
|
|
|
|
|
|
static const char *prg_cache_get(unsigned long inode)
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -296,6 +319,16 @@ static const char *prg_cache_get(unsigne
|
2006-01-17 10:27:02 +00:00
|
|
|
return("-");
|
|
|
|
}
|
|
|
|
|
|
|
|
+static const char *prg_cache_get_con(unsigned long inode)
|
|
|
|
+{
|
|
|
|
+ unsigned hi=PRG_HASHIT(inode);
|
|
|
|
+ struct prg_node *pn;
|
|
|
|
+
|
|
|
|
+ for (pn=prg_hash[hi];pn;pn=pn->next)
|
|
|
|
+ if (pn->inode==inode) return(pn->scon);
|
|
|
|
+ return("-");
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
static void prg_cache_clear(void)
|
|
|
|
{
|
|
|
|
struct prg_node **pnp,*pn;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -373,6 +406,7 @@ static void prg_cache_load(void)
|
2006-01-17 10:27:02 +00:00
|
|
|
const char *cs,*cmdlp;
|
|
|
|
DIR *dirproc=NULL,*dirfd=NULL;
|
|
|
|
struct dirent *direproc,*direfd;
|
|
|
|
+ security_context_t scon=NULL;
|
|
|
|
|
|
|
|
if (prg_cache_loaded || !flag_prg) return;
|
|
|
|
prg_cache_loaded=1;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -436,7 +470,15 @@ static void prg_cache_load(void)
|
2006-01-17 10:27:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
snprintf(finbuf, sizeof(finbuf), "%s/%s", direproc->d_name, cmdlp);
|
|
|
|
- prg_cache_add(inode, finbuf);
|
|
|
|
+#if HAVE_SELINUX
|
|
|
|
+ if (getpidcon(atoi(direproc->d_name), &scon) == -1) {
|
|
|
|
+ scon=strdup("-");
|
|
|
|
+ }
|
|
|
|
+ prg_cache_add(inode, finbuf, scon);
|
|
|
|
+ freecon(scon);
|
|
|
|
+#else
|
|
|
|
+ prg_cache_add(inode, finbuf, "-");
|
|
|
|
+#endif
|
|
|
|
}
|
|
|
|
closedir(dirfd);
|
|
|
|
dirfd = NULL;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -672,6 +714,9 @@ static void finish_this_one(int uid, uns
|
2011-12-06 18:15:09 +00:00
|
|
|
}
|
2006-01-17 10:27:02 +00:00
|
|
|
if (flag_prg)
|
2011-12-06 18:15:09 +00:00
|
|
|
printf(" %-" PROGNAME_WIDTHs "s",prg_cache_get(inode));
|
2006-01-17 10:27:02 +00:00
|
|
|
+ if (flag_selinux)
|
2011-12-06 18:15:09 +00:00
|
|
|
+ printf(" %-" SELINUX_WIDTHs "s",prg_cache_get_con(inode));
|
|
|
|
+
|
|
|
|
if (flag_opt)
|
|
|
|
printf(" %s", timers);
|
|
|
|
putchar('\n');
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -1495,7 +1540,9 @@ static void unix_do_one(int nr, const ch
|
2011-12-06 18:15:09 +00:00
|
|
|
printf("- ");
|
|
|
|
if (flag_prg)
|
|
|
|
printf(" %-" PROGNAME_WIDTHs "s",(has & HAS_INODE?prg_cache_get(inode):"-"));
|
|
|
|
-
|
|
|
|
+ if (flag_selinux)
|
|
|
|
+ printf(" %-" SELINUX_WIDTHs "s",(has & HAS_INODE?prg_cache_get_con(inode):"-"));
|
|
|
|
+
|
|
|
|
printf(" %s\n", path);
|
2006-01-17 10:27:02 +00:00
|
|
|
}
|
|
|
|
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -1514,6 +1561,7 @@ static int unix_info(void)
|
2006-01-17 10:27:02 +00:00
|
|
|
|
2011-12-06 18:15:09 +00:00
|
|
|
printf(_("\nProto RefCnt Flags Type State I-Node "));
|
2006-01-17 10:27:02 +00:00
|
|
|
print_progname_banner();
|
|
|
|
+ print_selinux_banner();
|
|
|
|
printf(_(" Path\n")); /* xxx */
|
|
|
|
|
|
|
|
{
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -1927,6 +1975,7 @@ static void usage(void)
|
2011-12-06 18:15:09 +00:00
|
|
|
fprintf(stderr, _(" -o, --timers display timers\n"));
|
|
|
|
fprintf(stderr, _(" -F, --fib display Forwarding Information Base (default)\n"));
|
|
|
|
fprintf(stderr, _(" -C, --cache display routing cache instead of FIB\n\n"));
|
|
|
|
+ fprintf(stderr, _(" -Z, --context display SELinux security context for sockets\n\n"));
|
|
|
|
|
|
|
|
fprintf(stderr, _(" <Socket>={-t|--tcp} {-u|--udp} {-U|--udplite} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom\n"));
|
|
|
|
fprintf(stderr, _(" <AF>=Use '-6|-4' or '-A <af>' or '--<af>'; default: %s\n"), DFLT_AF);
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -1977,6 +2026,7 @@ int main
|
2006-01-17 10:27:02 +00:00
|
|
|
{"cache", 0, 0, 'C'},
|
|
|
|
{"fib", 0, 0, 'F'},
|
|
|
|
{"groups", 0, 0, 'g'},
|
|
|
|
+ {"context", 0, 0, 'Z'},
|
|
|
|
{NULL, 0, 0, 0}
|
|
|
|
};
|
|
|
|
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -1988,7 +2038,7 @@ int main
|
2011-12-06 18:15:09 +00:00
|
|
|
getroute_init(); /* Set up AF routing support */
|
2006-01-17 10:27:02 +00:00
|
|
|
|
|
|
|
afname[0] = '\0';
|
2011-12-06 18:15:09 +00:00
|
|
|
- while ((i = getopt_long(argc, argv, "A:CFMacdeghiI::lnNoprsStuUvVWwx64?", longopts, &lop)) != EOF)
|
|
|
|
+ while ((i = getopt_long(argc, argv, "A:CFMacdeghiI::lnNoprsStuUvVWwx64?Z", longopts, &lop)) != EOF)
|
2006-01-17 10:27:02 +00:00
|
|
|
switch (i) {
|
|
|
|
case -1:
|
|
|
|
break;
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -2108,6 +2158,20 @@ int main
|
2006-01-17 10:27:02 +00:00
|
|
|
if (aftrans_opt("unix"))
|
|
|
|
exit(1);
|
|
|
|
break;
|
|
|
|
+ case 'Z':
|
|
|
|
+#if HAVE_SELINUX
|
|
|
|
+ if (is_selinux_enabled() <= 0) {
|
|
|
|
+ fprintf(stderr, _("SELinux is not enabled on this machine.\n"));
|
|
|
|
+ exit(1);
|
|
|
|
+ }
|
|
|
|
+ flag_prg++;
|
|
|
|
+ flag_selinux++;
|
|
|
|
+#else
|
|
|
|
+ fprintf(stderr, _("SELinux is not enabled for this application.\n"));
|
|
|
|
+ exit(1);
|
|
|
|
+#endif
|
|
|
|
+
|
|
|
|
+ break;
|
|
|
|
case '?':
|
|
|
|
case 'h':
|
|
|
|
usage();
|
2012-01-05 12:41:31 +00:00
|
|
|
@@ -2238,6 +2302,7 @@ int main
|
2007-05-22 10:49:15 +00:00
|
|
|
if (flag_exp > 1)
|
|
|
|
printf(_(" User Inode "));
|
|
|
|
print_progname_banner();
|
|
|
|
+ print_selinux_banner();
|
|
|
|
if (flag_opt)
|
|
|
|
printf(_(" Timer")); /* xxx */
|
|
|
|
printf("\n");
|