[PATCH] libselinux: label_file: handle newlines in file names

[PATCH] libselinux: label_file: handle newlines in file names

[Stephen Smalley]

From: Nick Kralevich <nnk@google.com>

restorecon on file names with newlines are not handled properly.
Use PCRE_DOTALL so that dots in regular expressions match all
characters, and don't exclude the newline character.

See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
for background.

Change-Id: I0dde8f2567305f746d19ebd75a9e2add7406eb9a
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 libselinux/src/label_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index 71b085a..9d116eb 100644
--- a/libselinux/src/label_file.c
+++ b/libselinux/src/label_file.c
@@ -129,7 +129,7 @@ static int compile_regex(struct saved_data *data, struct spec *spec, const char
 	*cp = '\0';
 
 	/* Compile the regular expression. */
-	spec->regex = pcre_compile(anchored_regex, 0, &tmperrbuf, &erroff, NULL);
+	spec->regex = pcre_compile(anchored_regex, PCRE_DOTALL, &tmperrbuf, &erroff, NULL);
 	free(anchored_regex);
 	if (!spec->regex) {
 		if (errbuf)
-- 
1.9.3

Re: [PATCH] libselinux: label_file: handle newlines in file names

[Steve Lawrence]

On 02/24/2015 10:43 AM, Stephen Smalley wrote:
> From: Nick Kralevich <nnk@google.com>
> 
> restorecon on file names with newlines are not handled properly.
> Use PCRE_DOTALL so that dots in regular expressions match all
> characters, and don't exclude the newline character.
> 
> See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
> for background.
> 
> Change-Id: I0dde8f2567305f746d19ebd75a9e2add7406eb9a
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>  libselinux/src/label_file.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
> index 71b085a..9d116eb 100644
> --- a/libselinux/src/label_file.c
> +++ b/libselinux/src/label_file.c
> @@ -129,7 +129,7 @@ static int compile_regex(struct saved_data *data, struct spec *spec, const char
>  	*cp = '\0';
>  
>  	/* Compile the regular expression. */
> -	spec->regex = pcre_compile(anchored_regex, 0, &tmperrbuf, &erroff, NULL);
> +	spec->regex = pcre_compile(anchored_regex, PCRE_DOTALL, &tmperrbuf, &erroff, NULL);
>  	free(anchored_regex);
>  	if (!spec->regex) {
>  		if (errbuf)
> 

Do we need a similar change in sefcontext_compile.c? It also looks like
mcstrans compiles regular expressions, but I don't think those are
related to matching paths.

- Steve

Re: [PATCH] libselinux: label_file: handle newlines in file names

[Stephen Smalley]

On 02/24/2015 11:45 AM, Steve Lawrence wrote:
> On 02/24/2015 10:43 AM, Stephen Smalley wrote:
>> From: Nick Kralevich <nnk@google.com>
>>
>> restorecon on file names with newlines are not handled properly.
>> Use PCRE_DOTALL so that dots in regular expressions match all
>> characters, and don't exclude the newline character.
>>
>> See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
>> for background.
>>
>> Change-Id: I0dde8f2567305f746d19ebd75a9e2add7406eb9a
>> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
>> ---
>>  libselinux/src/label_file.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
>> index 71b085a..9d116eb 100644
>> --- a/libselinux/src/label_file.c
>> +++ b/libselinux/src/label_file.c
>> @@ -129,7 +129,7 @@ static int compile_regex(struct saved_data *data, struct spec *spec, const char
>>  	*cp = '\0';
>>  
>>  	/* Compile the regular expression. */
>> -	spec->regex = pcre_compile(anchored_regex, 0, &tmperrbuf, &erroff, NULL);
>> +	spec->regex = pcre_compile(anchored_regex, PCRE_DOTALL, &tmperrbuf, &erroff, NULL);
>>  	free(anchored_regex);
>>  	if (!spec->regex) {
>>  		if (errbuf)
>>
> 
> Do we need a similar change in sefcontext_compile.c? It also looks like
> mcstrans compiles regular expressions, but I don't think those are
> related to matching paths.

Yes for sefcontext_compile.c (doesn't exist in Android's libselinux,
which does not yet include the file_contexts.bin support).