Re: semanage non MLS breakage

[Ivan Gyurdiev <ivg2@cornell.edu>]

[-- Attachment #1: Type: text/plain, Size: 418 bytes --]


> It's an invalid context, I don't think there is anything you *can* do 
> except fatally error. Consider what would happen if there was a proper 
> MLS context with multiple levels on an MCS policy...
Well, in that case, patch attached. Also fixes printing of mls_range in 
the error case for seuser_validate.
Applies on top of the previous one.

That leaves the semanage tool to audit and fix for non-MLS issues.



[-- Attachment #2: libsemanage.sepol.mls_fix2.diff --]
[-- Type: text/x-patch, Size: 3383 bytes --]

diff -Naurp --exclude Makefile --exclude 'fcontext*' --exclude libselinux --exclude genhomedircon.c --exclude direct_api.c --exclude-from excludes old/libsemanage/src/seusers_local.c new/libsemanage/src/seusers_local.c
--- old/libsemanage/src/seusers_local.c	2006-02-17 16:29:48.000000000 -0500
+++ new/libsemanage/src/seusers_local.c	2006-02-19 12:11:55.000000000 -0500
@@ -126,6 +126,7 @@ static int validate_handler(
 		if (sepol_mls_contains(handle->sepolh, policydb, 
 			user_mls_range, mls_range, &mls_ok) < 0)
 			goto err;
+
 		if (!mls_ok) {
 			ERR(handle, "MLS range %s for Unix user %s "
 			     "exceeds allowed range %s for SELinux user %s",
@@ -133,24 +134,29 @@ static int validate_handler(
 			goto invalid;
 		}
 
-	} else if (mls_range)
-		WARN(handle, "MLS is disabled, MLS range %s "
-			"Unix user %s ignored", mls_range, name);
+	} else if (mls_range) {
+		ERR(handle, "MLS is disabled, but MLS range %s "
+			"was found for Unix user %s", mls_range, name);
+		goto invalid;
+	}
 
 	semanage_user_key_free(key);
 	semanage_user_free(user);
 	return 0;
 
 	err:
-	ERR(handle, "could not check if the seuser mapping "
-		"%s -> (%s, %s) is valid", name, sename, mls_range);
+	ERR(handle, "could not check if seuser mapping for %s is valid", name);
 	semanage_user_key_free(key);
 	semanage_user_free(user);
 	return -1;
 
 	invalid:
-	ERR(handle, "seuser mapping %s -> (%s, %s) is invalid",
-		name, sename, mls_range);
+	if (mls_range)
+		ERR(handle, "seuser mapping [%s -> (%s, %s)] is invalid",
+			name, sename, mls_range);
+	else 
+		ERR(handle, "seuser mapping [%s -> %s] is invalid",
+			name, sename);
 	semanage_user_key_free(key);
 	semanage_user_free(user);
 	return -1;
diff -Naurp --exclude Makefile --exclude 'fcontext*' --exclude libselinux --exclude genhomedircon.c --exclude direct_api.c --exclude-from excludes old/libsepol/src/context.c new/libsepol/src/context.c
--- old/libsepol/src/context.c	2006-01-06 09:36:28.000000000 -0500
+++ new/libsepol/src/context.c	2006-02-19 12:06:45.000000000 -0500
@@ -194,12 +194,11 @@ int context_from_record(
 
 	/* MLS */
 	if (mls && !policydb->mls) {
-		WARN(handle, "mls context \"%s\" ignored, since "
-				"mls is disabled", mls);
-		mls = NULL;
+		ERR(handle, "MLS is disabled, but MLS context \"%s\" found", mls);
+		goto err_destroy;
 	}
 	else if (!mls && policydb->mls) {
-	 	ERR(handle, "mls is enabled, but no mls context found");
+	 	ERR(handle, "MLS is enabled, but no MLS context found");
 		goto err_destroy;
 	}
 	if (mls && (mls_from_string(handle, policydb, mls, scontext) < 0)) 
diff -Naurp --exclude Makefile --exclude 'fcontext*' --exclude libselinux --exclude genhomedircon.c --exclude direct_api.c --exclude-from excludes old/libsepol/src/users.c new/libsepol/src/users.c
--- old/libsepol/src/users.c	2006-02-17 16:29:48.000000000 -0500
+++ new/libsepol/src/users.c	2006-02-19 12:07:32.000000000 -0500
@@ -219,10 +219,10 @@ int sepol_user_modify(
 		}
 		context_destroy(&context);
 
-	} else {
-		if (cmls_level != NULL || cmls_range != NULL)
-			WARN(handle, "MLS is disabled, MLS level/range "
-				"ignored for user %s", cname);
+	} else if (cmls_level != NULL || cmls_range != NULL) {
+		ERR(handle, "MLS is disabled, but MLS level/range "
+			"was found for user %s", cname);
+		goto err;
 	}
 
 	/* If there are no errors, and this is a new user, add the user to policy */