[PATCH] libselinux: introduce enforcing mode override option

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Introduces an enforcing mode override option, so the object manager
can bring up the AVC in permissive mode on an enforcing system, or
vice versa.

Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
---

 include/selinux/avc.h |   11 ++++++++++-
 src/avc.c             |   29 ++++++++++++++++++++---------
 src/avc_internal.c    |    7 +++++--
 src/avc_internal.h    |    1 +
 4 files changed, 36 insertions(+), 12 deletions(-)


Index: libselinux/include/selinux/avc.h
===================================================================
--- libselinux/include/selinux/avc.h	(revision 2671)
+++ libselinux/include/selinux/avc.h	(working copy)
@@ -157,6 +157,15 @@
 };
 
 /*
+ * Available options
+ */
+
+/* no-op option, useful for unused slots in an array of options */
+#define AVC_OPT_UNUSED		0
+/* override kernel enforcing mode (boolean value) */
+#define AVC_OPT_SETENFORCE	1
+
+/*
  * AVC operations
  */
 
@@ -188,7 +197,7 @@
  *
  * This function is identical to avc_init(), except the message prefix
  * is set to "avc" and any callbacks desired should be specified via
- * selinux_set_callback().  No options are currently supported.
+ * selinux_set_callback().  Available options are listed above.
  */
 int avc_open(struct selinux_opt *opts, unsigned nopts);
 
Index: libselinux/src/avc.c
===================================================================
--- libselinux/src/avc.c	(revision 2671)
+++ libselinux/src/avc.c	(working copy)
@@ -157,10 +157,19 @@
 	return rc;
 }
 
-int avc_open(struct selinux_opt *opts __attribute__((unused)),
-	     unsigned nopts __attribute__((unused)))
+int avc_open(struct selinux_opt *opts, unsigned nopts)
 {
-    return avc_init("avc", NULL, NULL, NULL, NULL);
+	avc_setenforce = 0;
+
+	while (nopts--)
+		switch(opts[nopts].type) {
+		case AVC_OPT_SETENFORCE:
+			avc_setenforce = 1;
+			avc_enforcing = !!opts[nopts].value;
+			break;
+		}
+
+	return avc_init("avc", NULL, NULL, NULL, NULL);
 }
 
 int avc_init(const char *prefix,
@@ -213,13 +222,15 @@
 		avc_node_freelist = new;
 	}
 
-	rc = security_getenforce();
-	if (rc < 0) {
-		avc_log("%s:  could not determine enforcing mode\n",
-			avc_prefix);
-		goto out;
+	if (!avc_setenforce) {
+		rc = security_getenforce();
+		if (rc < 0) {
+			avc_log("%s:  could not determine enforcing mode\n",
+				avc_prefix);
+			goto out;
+		}
+		avc_enforcing = rc;
 	}
-	avc_enforcing = rc;
 
 	rc = avc_netlink_open(avc_using_threads);
 	if (rc < 0) {
Index: libselinux/src/avc_internal.h
===================================================================
--- libselinux/src/avc_internal.h	(revision 2671)
+++ libselinux/src/avc_internal.h	(working copy)
@@ -74,6 +74,7 @@
 extern char avc_prefix[AVC_PREFIX_SIZE] hidden;
 extern int avc_running hidden;
 extern int avc_enforcing hidden;
+extern int avc_setenforce hidden;
 
 /* user-supplied callback interface for avc */
 static inline void *avc_malloc(size_t size)
Index: libselinux/src/avc_internal.c
===================================================================
--- libselinux/src/avc_internal.c	(revision 2671)
+++ libselinux/src/avc_internal.c	(working copy)
@@ -46,6 +46,7 @@
 char avc_prefix[AVC_PREFIX_SIZE] = "uavc";
 int avc_running = 0;
 int avc_enforcing = 1;
+int avc_setenforce = 0;
 int avc_netlink_trouble = 0;
 
 /* netlink socket code */
@@ -151,6 +152,8 @@
 		struct selnl_msg_setenforce *msg = NLMSG_DATA(nlh);
 		avc_log("%s:  received setenforce notice (enforcing=%d)\n",
 			avc_prefix, msg->val);
+		if (avc_setenforce)
+			break;
 		avc_enforcing = msg->val;
 		if (avc_enforcing && (rc = avc_ss_reset(0)) < 0) {
 			avc_log("%s:  cache reset returned %d (errno %d)\n",
@@ -183,7 +186,7 @@
 int avc_netlink_check_nb(void)
 {
 	int rc;
-	char buf[1024];
+	char buf[1024] __attribute__ ((aligned));
 
 	while (1) {
 		errno = 0;
@@ -209,7 +212,7 @@
 void avc_netlink_loop(void)
 {
 	int rc;
-	char buf[1024];
+	char buf[1024] __attribute__ ((aligned));
 
 	while (1) {
 		errno = 0;

-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.