* [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel @ 2011-08-03 20:58 Daniel J Walsh 2011-08-04 14:58 ` Stephen Smalley 0 siblings, 1 reply; 6+ messages in thread From: Daniel J Walsh @ 2011-08-03 20:58 UTC (permalink / raw) To: eparis; +Cc: selinux [-- Attachment #1: Type: text/plain, Size: 346 bytes --] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch looks good to me. acked. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk45tn8ACgkQrlYvE4MpobMCxgCfXH6HOZTQkP4COSovye5EM2H2 7zUAoN2kgLGrJ9Ust2zHvLNT7OHsP9fd =iKy+ -----END PGP SIGNATURE----- [-- Attachment #2: 0032-policycoreutils-fixfiles-use-new-kernel-seclabel-opt.patch --] [-- Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel 2011-08-03 20:58 [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel Daniel J Walsh @ 2011-08-04 14:58 ` Stephen Smalley 2011-08-12 18:22 ` Eric Paris 0 siblings, 1 reply; 6+ messages in thread From: Stephen Smalley @ 2011-08-04 14:58 UTC (permalink / raw) To: Daniel J Walsh; +Cc: eparis, selinux On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > This patch looks good to me. acked. When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel 2011-08-04 14:58 ` Stephen Smalley @ 2011-08-12 18:22 ` Eric Paris 2011-08-12 18:44 ` Stephen Smalley 0 siblings, 1 reply; 6+ messages in thread From: Eric Paris @ 2011-08-12 18:22 UTC (permalink / raw) To: Stephen Smalley; +Cc: Daniel J Walsh, eparis, selinux [-- Attachment #1: Type: text/plain, Size: 418 bytes --] On Thu, Aug 4, 2011 at 10:58 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote: > On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote: >> This patch looks good to me. acked. > > When similar logic was added to setfiles, we included a kernel version > check (>= 2.6.30) to ensure that we didn't end up excluding all > filesystems on older kernels that do not report seclabel. Patch replaced with the attached. -Eric [-- Attachment #2: 0001-policycoreutils-fixfiles-use-new-kernel-seclabel-opt.patch --] [-- Type: text/x-patch, Size: 2960 bytes --] From 3d39e0e30ad34500917e695a3a3f3e4f3614dc8f Mon Sep 17 00:00:00 2001 From: Eric Paris <eparis@redhat.com> Date: Sun, 10 Jul 2011 16:09:11 +0200 Subject: [PATCH] policycoreutils: fixfiles: use new kernel seclabel option The kernel now outputs a mount option called 'seclabel' which indicates if the filesystem supposed security labeling. Use that instead of having to update some hard coded list of acceptable filesystems (that may or may not be acceptable depending on if they were compiled with security xattrs) Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com> --- policycoreutils/scripts/fixfiles | 39 ++++++++++++++++++++++++++++++++++++- 1 files changed, 37 insertions(+), 2 deletions(-) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles index ba59d87..adc95fe 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -20,6 +20,41 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +VER=`uname -r` +MAJOR=`echo $VER | cut -d. -f1` +MINOR=`echo $VER | cut -d. -f2` +MICRO=`echo $VER | cut -d. -f3` +# +# Get all mount points that support labeling. Use the 'seclabel' field if it +# is available. Else fall back to known fs types which likely support xattrs +# and we know were not context mounted. +# +get_all_labeled_mounts() { +FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" +for i in $FS; do + if [ $MAJOR -le 2 ] && [ $MINOR -le 6 ] && [ $MICRO -lt 30 ] + then + grep " $i " /proc/self/mounts | grep -v "context=" | egrep --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i + else + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)seclabel(,|$)' && echo $i + fi +done +} + +get_rw_labeled_mounts() { +FS=`get_all_labeled_mounts | sort | uniq` +for i in $FS; do + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)rw(,|$)' && echo $i +done +} + +get_ro_labeled_mounts() { +FS=`get_all_labeled_mounts | sort | uniq` +for i in $FS; do + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)ro(,|$)' && echo $i +done +} + exclude_dirs_from_relabelling() { exclude_from_relabelling= if [ -e /etc/selinux/fixfiles_exclude_dirs ] @@ -64,8 +99,8 @@ SYSLOGFLAG="-l" LOGGER=/usr/sbin/logger SETFILES=/sbin/setfiles RESTORECON=/sbin/restorecon -FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';` -FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';` +FILESYSTEMSRW=`get_rw_labeled_mounts` +FILESYSTEMSRO=`get_ro_labeled_mounts` FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO" SELINUXTYPE="targeted" if [ -e /etc/selinux/config ]; then -- 1.7.6 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel 2011-08-12 18:22 ` Eric Paris @ 2011-08-12 18:44 ` Stephen Smalley 2011-08-15 10:36 ` Daniel J Walsh 2011-08-15 15:27 ` Eric Paris 0 siblings, 2 replies; 6+ messages in thread From: Stephen Smalley @ 2011-08-12 18:44 UTC (permalink / raw) To: Eric Paris; +Cc: Daniel J Walsh, eparis, selinux On Fri, 2011-08-12 at 14:22 -0400, Eric Paris wrote: > On Thu, Aug 4, 2011 at 10:58 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote: > > On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote: > > >> This patch looks good to me. acked. > > > > When similar logic was added to setfiles, we included a kernel version > > check (>= 2.6.30) to ensure that we didn't end up excluding all > > filesystems on older kernels that do not report seclabel. > > Patch replaced with the attached. Your version comparison isn't quite right, e.g. consider 2.2.30. If you want a reliable version compare, you probably want to do something similar to KERNEL_VERSION() from include/linux/version.h and convert both versions to simple integers that can be compared. Or you could do something based on this gem: http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/ Or just rewrite fixfiles in a reasonable language ;) -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel 2011-08-12 18:44 ` Stephen Smalley @ 2011-08-15 10:36 ` Daniel J Walsh 2011-08-15 15:27 ` Eric Paris 1 sibling, 0 replies; 6+ messages in thread From: Daniel J Walsh @ 2011-08-15 10:36 UTC (permalink / raw) To: Stephen Smalley; +Cc: Eric Paris, eparis, selinux -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/12/2011 02:44 PM, Stephen Smalley wrote: > On Fri, 2011-08-12 at 14:22 -0400, Eric Paris wrote: >> On Thu, Aug 4, 2011 at 10:58 AM, Stephen Smalley >> <sds@tycho.nsa.gov> wrote: >>> On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote: >> >>>> This patch looks good to me. acked. >>> >>> When similar logic was added to setfiles, we included a kernel >>> version check (>= 2.6.30) to ensure that we didn't end up >>> excluding all filesystems on older kernels that do not report >>> seclabel. >> >> Patch replaced with the attached. > > Your version comparison isn't quite right, e.g. consider 2.2.30. If > you want a reliable version compare, you probably want to do > something similar to KERNEL_VERSION() from include/linux/version.h > and convert both versions to simple integers that can be compared. > Or you could do something based on this gem: > http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/ > > Or just rewrite fixfiles in a reasonable language ;) > Or stop supporting really old versions of kernels with the latest tool chain. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk5I9sAACgkQrlYvE4MpobMXqQCdHF3n5u/Yw6bHNteFU3UXOyoh i58An2VSHBmLU1dgHGuybzUiU+c0H4zc =F4xN -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel 2011-08-12 18:44 ` Stephen Smalley 2011-08-15 10:36 ` Daniel J Walsh @ 2011-08-15 15:27 ` Eric Paris 1 sibling, 0 replies; 6+ messages in thread From: Eric Paris @ 2011-08-15 15:27 UTC (permalink / raw) To: Stephen Smalley; +Cc: Eric Paris, Daniel J Walsh, selinux [-- Attachment #1: Type: text/plain, Size: 1031 bytes --] On 08/12/2011 02:44 PM, Stephen Smalley wrote: > On Fri, 2011-08-12 at 14:22 -0400, Eric Paris wrote: >> On Thu, Aug 4, 2011 at 10:58 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote: >>> On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote: >> >>>> This patch looks good to me. acked. >>> >>> When similar logic was added to setfiles, we included a kernel version >>> check (>= 2.6.30) to ensure that we didn't end up excluding all >>> filesystems on older kernels that do not report seclabel. >> >> Patch replaced with the attached. > > Your version comparison isn't quite right, e.g. consider 2.2.30. > If you want a reliable version compare, you probably want to do > something similar to KERNEL_VERSION() from include/linux/version.h and > convert both versions to simple integers that can be compared. Or you > could do something based on this gem: > http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/ > > Or just rewrite fixfiles in a reasonable language ;) Decided to go with the gem. [-- Attachment #2: 0001-policycoreutils-fixfiles-use-new-kernel-seclabel-opt.patch --] [-- Type: text/plain, Size: 3418 bytes --] From 1da72eea266fdee3603204423ab1d9e68ff05f79 Mon Sep 17 00:00:00 2001 From: Eric Paris <eparis@redhat.com> Date: Sun, 10 Jul 2011 16:09:11 +0200 Subject: [PATCH] policycoreutils: fixfiles: use new kernel seclabel option The kernel now outputs a mount option called 'seclabel' which indicates if the filesystem supposed security labeling. Use that instead of having to update some hard coded list of acceptable filesystems (that may or may not be acceptable depending on if they were compiled with security xattrs) Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com> --- policycoreutils/scripts/fixfiles | 48 ++++++++++++++++++++++++++++++++++++- 1 files changed, 46 insertions(+), 2 deletions(-) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles index ba59d87..54226eb 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -20,6 +20,50 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# seclabel support was added in 2.6.30. This function will return a positive +# number if the current kernel version is greater than 2.6.30, a negative +# number if the current is less than 2.6.30 and 0 if they are the same. +# +function useseclabel { + VER=`uname -r` + SUP=2.6.30 + expr '(' "$VER" : '\([^.]*\)' ')' '-' '(' "$SUP" : '\([^.]*\)' ')' '|' \ + '(' "$VER.0" : '[^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0" : '[^.]*[.]\([^.]*\)' ')' '|' \ + '(' "$VER.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')' +} + +# +# Get all mount points that support labeling. Use the 'seclabel' field if it +# is available. Else fall back to known fs types which likely support xattrs +# and we know were not context mounted. +# +get_all_labeled_mounts() { +FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" +for i in $FS; do + if [ `useseclabel` -ge 0 ] + then + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)seclabel(,|$)' && echo $i + else + grep " $i " /proc/self/mounts | grep -v "context=" | egrep --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i + fi +done +} + +get_rw_labeled_mounts() { +FS=`get_all_labeled_mounts | sort | uniq` +for i in $FS; do + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)rw(,|$)' && echo $i +done +} + +get_ro_labeled_mounts() { +FS=`get_all_labeled_mounts | sort | uniq` +for i in $FS; do + grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)ro(,|$)' && echo $i +done +} + exclude_dirs_from_relabelling() { exclude_from_relabelling= if [ -e /etc/selinux/fixfiles_exclude_dirs ] @@ -64,8 +108,8 @@ SYSLOGFLAG="-l" LOGGER=/usr/sbin/logger SETFILES=/sbin/setfiles RESTORECON=/sbin/restorecon -FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';` -FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';` +FILESYSTEMSRW=`get_rw_labeled_mounts` +FILESYSTEMSRO=`get_ro_labeled_mounts` FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO" SELINUXTYPE="targeted" if [ -e /etc/selinux/config ]; then -- 1.7.6 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-08-15 15:27 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2011-08-03 20:58 [PATCH 032/155] policycoreutils: fixfiles use new kernel seclabel Daniel J Walsh 2011-08-04 14:58 ` Stephen Smalley 2011-08-12 18:22 ` Eric Paris 2011-08-12 18:44 ` Stephen Smalley 2011-08-15 10:36 ` Daniel J Walsh 2011-08-15 15:27 ` Eric Paris
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.