Re: initial_sid context via libsepol

[Richard Haines <richard_c_haines@btinternet.com>]

[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]





On Friday, 4 March 2016, 21:18, "Roberts, William C" <william.c.roberts@intel.com> wrote:


>
>
> 
> 
>How can one obtain the same value as /sys/fs/selinux/initial_contexts/file via libsepol?
> 
>I’ve been digging around libsepol and its not quite clear to me.
> 
>It looks as though the record is here:
>                context_struct_t *a = &((policydb_t *)pol.db)->ocontexts[OCON_ISID]->context[0];
>                context_struct_t *b = &((policydb_t *)pol.db)->ocontexts[OCON_ISID]->context[1];
> 
>                printf("%u\n", a->type);
>                printf("%u\n",b->type);
> 
>Prints:
>185
>0
> 
>Not sure if this is right, and how to format the context struct to a string. I didn’t see any helpers.
>

>
I've attached an example, hope it's useful
>
> 
>Thanks,
>Bill
>_______________________________________________
>Selinux mailing list
>Selinux@tycho.nsa.gov
>To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
>

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: display-initial-sid-info.c --]
[-- Type: text/x-csrc, Size: 4145 bytes --]

/* gcc display-initial-sid-info.c -o display-initial-sid-info -lselinux /usr/lib64/libsepol.a */

#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
#include <sepol/policydb/policydb.h>

/* load_policy taken from sepolicy-analyze.c */
int load_policy(char *filename, policydb_t *policydb, struct policy_file *pf)
{
	int fd;
	struct stat sb;
	void *map;
	int ret;

	fd = open(filename, O_RDONLY);
	if (fd < 0) {
		fprintf(stderr, "Can't open '%s':  %s\n", filename, strerror(errno));
		return 1;
	}
	if (fstat(fd, &sb) < 0) {
		fprintf(stderr, "Can't stat '%s':  %s\n", filename, strerror(errno));
		close(fd);
		return 1;
	}
	map = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
	if (map == MAP_FAILED) {
		fprintf(stderr, "Can't mmap '%s':  %s\n", filename, strerror(errno));
		close(fd);
		return 1;
	}

	policy_file_init(pf);
	pf->type = PF_USE_MEMORY;
	pf->data = map;
	pf->len = sb.st_size;
	if (policydb_init(policydb)) {
		fprintf(stderr, "Could not initialize policydb!\n");
		close(fd);
		munmap(map, sb.st_size);
		return 1;
	}
	ret = policydb_read(policydb, pf, 0);
	if (ret) {
		fprintf(stderr, "error(s) encountered while parsing configuration\n");
		close(fd);
		munmap(map, sb.st_size);
		return 1;
	}
	return 0;
}

/* The initial SID names are not available when loading a binary policy.
 * They need to be taken from the policy 'initial_sids' file. However
 * they tend to be common so setools uses a table like this:
*/
static const char *const sidnames[] = {
	/* I've made them print neat & tidy, tidy & neat !!!*/
	"kernel         ",
	"security       ",
	"unlabeled      ",
	"fs             ",
	"file           ",
	"file_labels    ",
	"init           ",
	"any_socket     ",
	"port           ",
	"netif          ",
	"netmsg         ",
	"node           ",
	"igmp_packet    ",
	"icmp_socket    ",
	"tcp_socket     ",
	"sysctl_modprobe",
	"sysctl         ",
	"sysctl_fs      ",
	"sysctl_kernel  ",
	"sysctl_net     ",
	"sysctl_net_unix",
	"sysctl_vm      ",
	"sysctl_dev     ",
	"kmod           ",
	"policy         ",
	"scmp_packet    ",
	"devnull        "
};

/* This is reworked from libsepol/src/mls.c mls_compute_context_len() to print the MLS components.
 * Best seen on /etc/selinux/mls/policy/policy.29
 */
void mls_print(const policydb_t *policydb, ocontext_t *cur)
{
	unsigned int i, l, range;
	ebitmap_node_t *cnode;

	if (!policydb->mls)
		return;

	for (l = 0; l < 2; l++) {
		range = 0;
		printf(":%s", policydb->p_sens_val_to_name[cur->context[0].range.level[l].sens - 1]);

		ebitmap_for_each_bit(&cur->context[0].range.level[l].cat, cnode, i) {
			if (ebitmap_node_get_bit(cnode, i)) {
				if (range) {
					range++;
					continue;
				}

				printf(":%s", policydb->p_cat_val_to_name[i]);
				range++;
			} else {
				if (range > 1)
					printf(",%s",policydb->p_cat_val_to_name[i - 1]);

				range = 0;
			}
		}
		/* Handle case where last category is the end of range */
		if (range > 1)
			printf(".%s",policydb->p_cat_val_to_name[i - 1]);

		if (l == 0) {
			if (mls_level_eq(&cur->context[0].range.level[0], &cur->context[0].range.level[1]))
				break;
		}
	}
}

int main(int argc, char **argv)
{
	char *policy;
	struct policy_file pf;
	policydb_t policydb;
	ocontext_t *cur;
	int entry = 0;

	if (argc < 2) {
		printf("Need binary policy file:\n");
		printf("\t%s policy_file\n", argv[0]);
		exit(1);
	}

	policy = argv[1];
	if (load_policy(policy, &policydb, &pf))
		exit(1);

	/* Count entries */
	for (cur = policydb.ocontexts[OCON_ISID]; cur != NULL; cur = cur->next)
		entry++;

	printf("There are %d initial sids in the policy\n\n", entry);

	entry = 0;
	printf("SID  Name             Context\n");
	for (cur = policydb.ocontexts[OCON_ISID]; cur != NULL; cur = cur->next) {
		printf("%2d   %s  %s:%s:%s",
			    cur->sid[0],
			    sidnames[entry],
			    policydb.p_user_val_to_name[cur->context[0].user - 1],
			    policydb.p_role_val_to_name[cur->context[0].role - 1],
			    policydb.p_type_val_to_name[cur->context[0].type - 1]);

		mls_print(&policydb, cur);
		printf("\n");
		entry++;
	}

	exit(0);
}