Re: Security issues with local filesystem caching

[David Howells <dhowells@redhat.com>]

Stephen Smalley <sds@tycho.nsa.gov> wrote:

> You'd have to introduce one for your new config, as there isn't yet a
> common interface (also under discussion).  matchpathcon(3) is the
> interface for obtaining the install-time file context to apply for a
> given pathname.  In other cases, applications have been directly parsing
> their own config files, but I think that will change (again, that other
> thread).

Okay, what I've got for userspace so far is:

	[seclabel.c]
	#include <stdlib.h>
	#include <stdio.h>
	#include <selinux/selinux.h>

	int main(int argc, char *argv[])
	{
		security_context_t con;
		char *cachesecpath;

		if (argc == 1) {
			fprintf(stderr, "Format: %s <dir>\n", argv[0]);
			exit(2);
		}

		if (asprintf(&cachesecpath,
			     "%s/cachefiles_contexts",
			     selinux_contexts_path()
			     ) == -1
		    ) {
			perror("cachefilesd");
			return 1;
		}

		printf("path: %s\n", cachesecpath);

		if (matchpathcon_init(cachesecpath) < 0) {
			perror(cachesecpath);
			return 1;
		}

		if (matchpathcon(argv[1], 0, &con) == -1) {
			perror(argv[1]);
			return 1;
		}

		return 0;
	}

I've created a file of contexts:

	[/etc/selinux/targeted/contexts/cachefiles_contexts]
	/var/fscache(/.*)?	-d	system_u:object_r:cachefiles_t:s0

Which the program above seems to read quite happily.  However, I run into a
problem:

	path: /etc/selinux/targeted/contexts/cachefiles_contexts
	file_contexts:  invalid context system_u:object_r:cachefiles_t:s0
	/var/fscache/: Invalid argument

I assume this is due to "cachefiles_t" not being defined, but I'm not sure how
to do that.

Any advice?

Thanks,
David

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.