* Re: secon (Was: Policycoreutils patch)
[not found] ` <1148388875.24463.152.camel@moss-spartans.epoch.ncsc.mil>
@ 2006-05-25 21:25 ` James Antill
0 siblings, 0 replies; 4+ messages in thread
From: James Antill @ 2006-05-25 21:25 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SE Linux
[-- Attachment #1.1: Type: text/plain, Size: 944 bytes --]
On Tue, 2006-05-23 at 08:54 -0400, Stephen Smalley wrote:
> On Mon, 2006-05-22 at 17:08 -0400, James Antill wrote:
> > This is due to context_new(), can I fix this inside that function (Ie.
> > don't fail out when the passed value == "")?
>
> Seems like the caller should handle it instead. "" isn't a valid
> context, after all.
Fair enough.
> BTW, working off the sourceforge selinux subversion tree is preferred,
> svn co https://svn.sourceforge.net/svnroot/selinux/trunk selinux-usr
Ok, I can do that :).
> Note that we update the ChangeLog and VERSION files ourselves upon
> merging patches, no need to touch those.
Ok, here's the latest changes for secon. It's the above fixes and man
pages changes with sensitivity/clearance naming changes. Also a couple
of typos.
I've also re-included the policycoreutils change for setfiles, against
the selinux svn tree.
--
James Antill <jantill@redhat.com>
[-- Attachment #1.2: selinux-secon-con_new+clearance.patch --]
[-- Type: text/x-patch, Size: 8650 bytes --]
Index: policycoreutils/secon/secon.1
===================================================================
--- policycoreutils/secon/secon.1 (revision 19)
+++ policycoreutils/secon/secon.1 (working copy)
@@ -3,7 +3,7 @@
secon \- See a context, from a file, program or user input.
.SH SYNOPSIS
.B secon
-[\fB-hVurtlmPRfLp\fR]
+[\fB-hVurtscmPRfLp\fR]
[\fICONTEXT\fR]
.br
[\fB--file\fR]
@@ -39,11 +39,14 @@
\fB\-t\fR, \fB\-\-type\fR
show the type of the security context
.TP
-\fB\-l\fR, \fB\-\-level\fR
+\fB\-s\fR, \fB\-\-sensitivity\fR
show the sensitivity level of the security context
.TP
+\fB\-c\fR, \fB\-\-clearance\fR
+show the clearance level of the security context
+.TP
\fB\-m\fR, \fB\-\-mls-range\fR
-show the sensitivity level and clearance of the security context
+show the sensitivity level and clearance, as a range, of the security context
.TP
\fB\-R\fR, \fB\-\-raw\fR
outputs the sensitivity level and clearance in an untranslated format.
Index: policycoreutils/secon/secon.c
===================================================================
--- policycoreutils/secon/secon.c (revision 19)
+++ policycoreutils/secon/secon.c (working copy)
@@ -19,8 +19,8 @@
#define FALSE 0
#define SECON_CONF_PROG_NAME "secon" /* default program name */
-#define SECON_OPTS_SM "hVurtlmPRfLp" /* small options available, printing */
-#define SECON_OPTS_GO "hVurtlmPRf:L:p:" /* small options available, getopt */
+#define SECON_OPTS_SM "hVurtscmPRfLp" /* small options available, print */
+#define SECON_OPTS_GO "hVurtlscmPRf:L:p:" /* small options available, getopt */
#define OPTS_FROM_ARG 0
#define OPTS_FROM_FILE 1
@@ -35,17 +35,18 @@
struct
{
- unsigned int disp_user : 1;
- unsigned int disp_role : 1;
- unsigned int disp_type : 1;
- unsigned int disp_level : 1;
- unsigned int disp_mlsr : 1;
+ unsigned int disp_user : 1;
+ unsigned int disp_role : 1;
+ unsigned int disp_type : 1;
+ unsigned int disp_sen : 1;
+ unsigned int disp_clr : 1;
+ unsigned int disp_mlsr : 1;
- unsigned int disp_raw : 1;
+ unsigned int disp_raw : 1;
unsigned int disp_prompt : 1; /* no return, use : to sep */
- unsigned int from_type : 9; /* 16 bits */
+ unsigned int from_type : 8; /* 16 bits, uses 4 bits */
union
{
@@ -54,7 +55,7 @@
const char *link;
const char *arg;
} f;
-} opts[1] = {{FALSE, FALSE, FALSE, FALSE, FALSE,
+} opts[1] = {{FALSE, FALSE, FALSE, FALSE, FALSE, FALSE,
FALSE, FALSE, OPTS_FROM_ARG, {0}}};
@@ -62,16 +63,17 @@
{
fprintf(exit_code ? stderr : stdout,
" Usage: %s [-%s] [ context | - ]\n"
-" --help -h Show this message.\n"
-" --version -V Show the version.\n"
-" --prompt -P Output in a format good for a prompt.\n"
-" --user -u Show the user of the context.\n"
-" --role -r Show the role of the context.\n"
-" --type -t Show the type of the context.\n"
-" --level -l Show the sensitivity level of the context.\n"
-" --mls-range -m Show the sensitivity level and clearance of \n"
+" --help -h Show this message.\n"
+" --version -V Show the version.\n"
+" --prompt -P Output in a format good for a prompt.\n"
+" --user -u Show the user of the context.\n"
+" --role -r Show the role of the context.\n"
+" --type -t Show the type of the context.\n"
+" --sensitivity -s Show the sensitivity level of the context.\n"
+" --clearance -c Show the clearance level of the context.\n"
+" --mls-range -m Show the sensitivity to clearance range of \n"
" the context.\n"
-" --raw -R Show the context in \"raw\" format.\n"
+" --raw -R Show the context in \"raw\" format.\n"
" --current Get the context for the current process.\n"
" --self Get the context for the current process.\n"
" --self-exec Get the exec context for the current process.\n"
@@ -113,7 +115,8 @@
num += opts->disp_user;
num += opts->disp_role;
num += opts->disp_type;
- num += opts->disp_level;
+ num += opts->disp_sen;
+ num += opts->disp_clr;
num += opts->disp_mlsr;
return (num);
@@ -143,8 +146,10 @@
{"user", no_argument, NULL, 'u'},
{"role", no_argument, NULL, 'r'},
{"type", no_argument, NULL, 't'},
- {"level", no_argument, NULL, 'l'},
+ {"level", no_argument, NULL, 'l'}, /* compat. */
+ {"sensitivity", no_argument, NULL, 's'},
{"range", no_argument, NULL, 'm'},
+ {"clearance", no_argument, NULL, 'c'},
{"mls-range", no_argument, NULL, 'm'},
{"raw", no_argument, NULL, 'R'},
@@ -184,11 +189,13 @@
" %s version %s.\n", program_name, VERSION);
exit (EXIT_SUCCESS);
- case 'u': done = TRUE; opts->disp_user = !opts->disp_user; break;
- case 'r': done = TRUE; opts->disp_role = !opts->disp_role; break;
- case 't': done = TRUE; opts->disp_type = !opts->disp_type; break;
- case 'l': done = TRUE; opts->disp_level = !opts->disp_level; break;
- case 'm': done = TRUE; opts->disp_mlsr = !opts->disp_mlsr; break;
+ case 'u': done = TRUE; opts->disp_user = !opts->disp_user; break;
+ case 'r': done = TRUE; opts->disp_role = !opts->disp_role; break;
+ case 't': done = TRUE; opts->disp_type = !opts->disp_type; break;
+ case 'l': done = TRUE; opts->disp_sen = !opts->disp_sen; break;
+ case 's': done = TRUE; opts->disp_sen = !opts->disp_sen; break;
+ case 'c': done = TRUE; opts->disp_clr = !opts->disp_clr; break;
+ case 'm': done = TRUE; opts->disp_mlsr = !opts->disp_mlsr; break;
case 'P': opts->disp_prompt = !opts->disp_prompt; break;
@@ -235,9 +242,11 @@
opts->disp_user = TRUE;
opts->disp_role = TRUE;
opts->disp_type = TRUE;
- if (!opts->disp_prompt) /* when displaying prompt,
- just output "normal" by default */
- opts->disp_level = TRUE;
+ if (!opts->disp_prompt)
+ { /* when displaying prompt, just output "normal" by default */
+ opts->disp_sen = TRUE;
+ opts->disp_clr = TRUE;
+ }
opts->disp_mlsr = TRUE;
}
@@ -459,13 +468,24 @@
{
context_t con = NULL;
+ if (!*scon)
+ { /* --self-exec and --self-fs etc. */
+ if (opts->disp_user) disp__con_val("user", NULL);
+ if (opts->disp_role) disp__con_val("role", NULL);
+ if (opts->disp_type) disp__con_val("type", NULL);
+ if (opts->disp_sen) disp__con_val("sensitivity", NULL);
+ if (opts->disp_clr) disp__con_val("clearance", NULL);
+ if (opts->disp_mlsr) disp__con_val("mls-range", NULL);
+ return;
+ }
+
if (!(con = context_new(scon)))
- errx(EXIT_FAILURE, "Couln't create context from: %s", scon);
+ errx(EXIT_FAILURE, "Couldn't create context from: %s", scon);
if (opts->disp_user) disp__con_val("user", context_user_get(con));
if (opts->disp_role) disp__con_val("role", context_role_get(con));
if (opts->disp_type) disp__con_val("type", context_type_get(con));
- if (opts->disp_level)
+ if (opts->disp_sen)
{
const char *val = NULL;
char *tmp = NULL;
@@ -476,13 +496,32 @@
tmp = strdup(val);
if (!tmp)
- errx(EXIT_FAILURE, "Couln't create context from: %s", scon);
+ errx(EXIT_FAILURE, "Couldn't create context from: %s", scon);
if (strchr(tmp, '-')) *strchr(tmp, '-') = 0;
- disp__con_val("level", tmp);
+ disp__con_val("sensitivity", tmp);
free(tmp);
}
+ if (opts->disp_clr)
+ {
+ const char *val = NULL;
+ char *tmp = NULL;
+
+ val = context_range_get(con);
+ if (!val) val = ""; /* targeted has no "level" etc.,
+ any errors should happen at context_new() time */
+
+ tmp = strdup(val);
+ if (!tmp)
+ errx(EXIT_FAILURE, "Couldn't create context from: %s", scon);
+ if (strchr(tmp, '-'))
+ disp__con_val("clearance", strchr(tmp, '-') + 1);
+ else
+ disp__con_val("clearance", tmp);
+
+ free(tmp);
+ }
if (opts->disp_mlsr) disp__con_val("mls-range", context_range_get(con));
[-- Attachment #1.3: selinux-audit-mass-relabel.patch --]
[-- Type: text/x-patch, Size: 2704 bytes --]
Index: policycoreutils/setfiles/setfiles.c
===================================================================
--- policycoreutils/setfiles/setfiles.c (revision 19)
+++ policycoreutils/setfiles/setfiles.c (working copy)
@@ -75,7 +75,12 @@
#include <selinux/selinux.h>
#include <syslog.h>
#include <libgen.h>
+#include <libaudit.h>
+#ifndef AUDIT_FS_RELABEL
+#define AUDIT_FS_RELABEL 2309
+#endif
+
static int add_assoc = 1;
static FILE *outfile=NULL;
static int force=0;
@@ -395,7 +400,7 @@
/* trim trailing /, if present */
len = strlen(rootpath);
- while ('/' == rootpath[len - 1])
+ while (len && ('/' == rootpath[len - 1]))
rootpath[--len] = 0;
rootpathlen = len;
}
@@ -443,11 +448,35 @@
return 0;
}
+static void maybe_audit_mass_relabel(int done_root, int errs)
+{
+ int audit_fd = -1;
+ int rc = 0;
+
+ if (!done_root) /* only audit a forced full relabel */
+ return;
+
+ audit_fd = audit_open();
+
+ if (audit_fd < 0) {
+ fprintf(stderr, "Error connecting to audit system.\n");
+ return;
+ }
+
+ rc = audit_log_user_message(audit_fd, AUDIT_FS_RELABEL,
+ "op=mass relabel", NULL, NULL, NULL, !errs);
+ if (rc <= 0) {
+ fprintf(stderr, "Error sending audit message: %s.\n", strerror(errno));
+ }
+ audit_close(audit_fd);
+}
+
int main(int argc, char **argv)
{
struct stat sb;
int opt, rc, i;
-
+ int done_root = 0; /* have we processed the / directory as an arg */
+
memset(excludeArray,0, sizeof(excludeArray));
/* Validate all file contexts during matchpathcon_init. */
@@ -618,6 +647,8 @@
}
else for (; optind < argc; optind++)
{
+ done_root |= !strcmp(argv[optind], "/");
+
if (NULL != rootpath) {
qprintf("%s: labeling files, pretending %s is /\n",
argv[0], rootpath);
@@ -648,6 +679,7 @@
fprintf(stderr,
"%s: error while labeling files under %s\n",
argv[0], argv[optind]);
+ maybe_audit_mass_relabel(done_root, 1);
exit(1);
}
}
@@ -664,6 +696,8 @@
matchpathcon_filespec_destroy();
}
+ maybe_audit_mass_relabel(done_root, 0);
+
if (warn_no_match)
matchpathcon_checkmatches(argv[0]);
Index: policycoreutils/setfiles/Makefile
===================================================================
--- policycoreutils/setfiles/Makefile (revision 19)
+++ policycoreutils/setfiles/Makefile (working copy)
@@ -7,6 +7,7 @@
CFLAGS = -Werror -Wall -W
override CFLAGS += -D_FILE_OFFSET_BITS=64 -I$(PREFIX)/include
LDLIBS = -lselinux -lsepol -L$(LIBDIR)
+LDLIBS += -laudit
all: setfiles
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 191 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread