1d04ad9053
- Improve label collection for mounts and devices Fixes: https://github.com/containers/udica/issues/98 https://github.com/containers/udica/issues/109
55 lines
1.7 KiB
Diff
55 lines
1.7 KiB
Diff
From 2e1f70537bf556a0f2238104e4fb3cf8518fcfc4 Mon Sep 17 00:00:00 2001
|
|
From: Vit Mojzis <vmojzis@redhat.com>
|
|
Date: Fri, 29 Apr 2022 16:15:06 +0200
|
|
Subject: [PATCH] Improve label collection for mounts and devices
|
|
|
|
Catch exception triggered by selabel_lookup when it encounters file
|
|
context definition containing "<<none>>"
|
|
|
|
Real label of given path may differ from what selable_lookup
|
|
(matchpathcon) returns. Udica should allow access to both.
|
|
|
|
Fixes:
|
|
https://github.com/containers/udica/issues/98
|
|
https://github.com/containers/udica/issues/109
|
|
---
|
|
udica/policy.py | 21 ++++++++++++++++-----
|
|
1 file changed, 16 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/udica/policy.py b/udica/policy.py
|
|
index 07d957c..1d53e2a 100644
|
|
--- a/udica/policy.py
|
|
+++ b/udica/policy.py
|
|
@@ -67,12 +67,23 @@ def list_contexts(directory):
|
|
contexts.append(semanage.semanage_context_get_type(context))
|
|
|
|
selabel = selinux.selabel_open(selinux.SELABEL_CTX_FILE, None, 0)
|
|
- (rc, context) = selinux.selabel_lookup(selabel, directory, 0)
|
|
- if context == None:
|
|
- if exists(directory) == False:
|
|
- exit(1)
|
|
+ try:
|
|
+ (rc, context) = selinux.selabel_lookup(selabel, directory, 0)
|
|
+ except FileNotFoundError:
|
|
+ # File context definition containing "<<none>>" triggers exception
|
|
+ context = None
|
|
+ if context:
|
|
+ contexts.append(context.split(":")[2])
|
|
+
|
|
+ # Get the real label (ls -lZ) - may differ from what selabel_lookup returns
|
|
+ try:
|
|
context = selinux.getfilecon(directory)[1]
|
|
- contexts.append(context.split(":")[2])
|
|
+ except FileNotFoundError:
|
|
+ context = None
|
|
+
|
|
+ if context:
|
|
+ contexts.append(context.split(":")[2])
|
|
+
|
|
return contexts
|
|
|
|
|
|
--
|
|
2.35.1
|
|
|