[patch] libsemanage: don't call genhomedircon if policy was not rebuilt

[patch] libsemanage: don't call genhomedircon if policy was not rebuilt

[Stephen Smalley]

See:
https://bugzilla.redhat.com/show_bug.cgi?id=441379

It appears to me that what is happening here is we have a case where
nothing is being rebuilt (semanage boolean -D is being applied but there
are no local boolean definitions and thus no change), and thus
semanage_direct_commit() does not rebuild the policy (conditional on
sh->do_rebuild || modified), leaving the out policydb == NULL.  Then
when it calls semanage_genhomedircon(sh, out, 1) the NULL policydb
pointer ultimately gets passed down to libsepol and that then triggers a
seg fault upon the attempted dereference.

This patch ensures that we do not call genhomedircon if the policy was
not rebuilt, as there is no need to regenerate home directory contexts
in that situation.  This avoids the bug for semanage boolean -D while
still properly handling semodule -Bn aka genhomedircon or other
operations.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

---

 libsemanage/src/direct_api.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: trunk/libsemanage/src/direct_api.c
===================================================================
--- trunk/libsemanage/src/direct_api.c	(revision 2860)
+++ trunk/libsemanage/src/direct_api.c	(working copy)
@@ -708,7 +708,7 @@
 	/* run genhomedircon if its enabled, this should be the last operation
 	 * which requires the out policydb */
 	if (!sh->conf->disable_genhomedircon) {
-		if ((retval =
+		if (out && (retval =
 		     semanage_genhomedircon(sh, out, 1)) != 0) {
 			ERR(sh, "semanage_genhomedircon returned error code %d.",
 			    retval);


-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] libsemanage: don't call genhomedircon if policy was not rebuilt

[Joshua Brindle]

Stephen Smalley wrote:
> See:
> https://bugzilla.redhat.com/show_bug.cgi?id=441379
> 
> It appears to me that what is happening here is we have a case where
> nothing is being rebuilt (semanage boolean -D is being applied but there
> are no local boolean definitions and thus no change), and thus
> semanage_direct_commit() does not rebuild the policy (conditional on
> sh->do_rebuild || modified), leaving the out policydb == NULL.  Then
> when it calls semanage_genhomedircon(sh, out, 1) the NULL policydb
> pointer ultimately gets passed down to libsepol and that then triggers a
> seg fault upon the attempted dereference.
> 
> This patch ensures that we do not call genhomedircon if the policy was
> not rebuilt, as there is no need to regenerate home directory contexts
> in that situation.  This avoids the bug for semanage boolean -D while
> still properly handling semodule -Bn aka genhomedircon or other
> operations.
> 
> Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

Acked-By: Joshua Brindle <method@manicmethod.com>

> 
> ---
> 
>  libsemanage/src/direct_api.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: trunk/libsemanage/src/direct_api.c
> ===================================================================
> --- trunk/libsemanage/src/direct_api.c	(revision 2860)
> +++ trunk/libsemanage/src/direct_api.c	(working copy)
> @@ -708,7 +708,7 @@
>  	/* run genhomedircon if its enabled, this should be the last operation
>  	 * which requires the out policydb */
>  	if (!sh->conf->disable_genhomedircon) {
> -		if ((retval =
> +		if (out && (retval =
>  		     semanage_genhomedircon(sh, out, 1)) != 0) {
>  			ERR(sh, "semanage_genhomedircon returned error code %d.",
>  			    retval);
> 
> 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.