Question about stat

Question about stat

[KaiGai Kohei]

[-- Attachment #1: Type: text/plain, Size: 471 bytes --]

I found a strange behavior of the stat in coreutils-5.97-14.fc7.src.rpm.

see below,

[kaigai@masu ~]$ stat -c "%C" mytest.sql
(null)
[kaigai@masu ~]$ stat -Z -c "%C" mytest.sql
user_u:object_r:user_home_t:s0
[kaigai@masu ~]$

Because stat command without '-Z' option doesn't try to obtain
the security context of the files specified, the format string
which contains "%C" doesn't work correctly.

Is it expected behavior?

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

[-- Attachment #2: coreutils-selinux-fix-stat.patch --]
[-- Type: text/x-patch, Size: 1174 bytes --]

--- coreutils-5.97.orig/src/stat.c	2006-11-21 20:44:35.000000000 +0900
+++ coreutils-5.97.kg/src/stat.c	2006-11-21 20:53:31.000000000 +0900
@@ -711,11 +711,15 @@ do_statfs (char const *filename, bool te
   STRUCT_STATVFS statfsbuf;
   SECURITY_ID_T scontext = NULL;
 #ifdef WITH_SELINUX
-  if(secure)
-    if (getfilecon(filename,&scontext)<0) {
-      perror (filename);
-      return false;
+  if (is_selinux_enabled()) {
+    if (getfilecon(filename,&scontext) < 0) {
+      if (secure) {
+	perror (filename);
+	return false;
+      }
+      scontext = NULL;
     }
+  }
 #endif
 
   if (STATFS (filename, &statfsbuf) != 0)
@@ -775,17 +779,17 @@ do_stat (char const *filename, bool foll
     }
 
 #ifdef WITH_SELINUX
-  if(secure) {
-    int i;
-    if (!follow_links) 
-      i=lgetfilecon(filename, &scontext);
-    else
-      i=getfilecon(filename, &scontext);
-    if (i == -1)
-      {
+  if (is_selinux_enabled()) {
+    int rc = (!follow_links
+	      ? lgetfilecon(filename, &scontext)
+	      : getfilecon(filename, &scontext));
+    if (rc < 0) {
+      scontext = NULL;
+      if (secure) {
 	perror (filename);
 	return false;
       }
+    }
   }
 #endif
 

Re: Question about stat

[Stephen Smalley]

On Tue, 2006-11-21 at 21:24 +0900, KaiGai Kohei wrote:
> I found a strange behavior of the stat in coreutils-5.97-14.fc7.src.rpm.
> 
> see below,
> 
> [kaigai@masu ~]$ stat -c "%C" mytest.sql
> (null)
> [kaigai@masu ~]$ stat -Z -c "%C" mytest.sql
> user_u:object_r:user_home_t:s0
> [kaigai@masu ~]$
> 
> Because stat command without '-Z' option doesn't try to obtain
> the security context of the files specified, the format string
> which contains "%C" doesn't work correctly.
> 
> Is it expected behavior?

That sounds like a bug to me; the use of '%C' in the format string
should implicitly enable the invocation of getfilecon.  I'd suggest
filing a bug against coreutils in fedora devel at bugzilla.redhat.com,
as there is no "upstream" repository presently for the coreutils selinux
patch.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question about stat

[KaiGai Kohei]

Stephen Smalley wrote:
> On Tue, 2006-11-21 at 21:24 +0900, KaiGai Kohei wrote:
>> I found a strange behavior of the stat in coreutils-5.97-14.fc7.src.rpm.
>>
>> see below,
>>
>> [kaigai@masu ~]$ stat -c "%C" mytest.sql
>> (null)
>> [kaigai@masu ~]$ stat -Z -c "%C" mytest.sql
>> user_u:object_r:user_home_t:s0
>> [kaigai@masu ~]$
>>
>> Because stat command without '-Z' option doesn't try to obtain
>> the security context of the files specified, the format string
>> which contains "%C" doesn't work correctly.
>>
>> Is it expected behavior?
> 
> That sounds like a bug to me; the use of '%C' in the format string
> should implicitly enable the invocation of getfilecon.  I'd suggest
> filing a bug against coreutils in fedora devel at bugzilla.redhat.com,
> as there is no "upstream" repository presently for the coreutils selinux
> patch.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216672

I filed it at bugzilla.redhat.com.

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.