[PATCH] auvirt: Add security context to "relabel{to, from}" AVC records

[PATCH] auvirt: Add security context to "relabel{to, from}" AVC records

[Marcelo Cerri]

With this patch, auvirt prints one more field for AVC records when using the
"--all-events" option. The target context is added to "relabelto" AVC records
and the source context to "relabelfrom" AVC records.
---
 tools/auvirt/auvirt.c |   17 ++++++++++++++++-
 1 files changed, 16 insertions(+), 1 deletions(-)

diff --git a/tools/auvirt/auvirt.c b/tools/auvirt/auvirt.c
index e5c5ef6..9b71a3c 100644
--- a/tools/auvirt/auvirt.c
+++ b/tools/auvirt/auvirt.c
@@ -91,6 +91,7 @@ struct event {
 	char *comm;
 	char *seresult;
 	char *seperms;
+	char *context;
 	/* Fields to print proof information: */
 	struct record_id proof[4];
 };
@@ -130,6 +131,7 @@ void event_free(struct event *event)
 		free(event->cgroup_class);
 		free(event->cgroup_detail);
 		free(event->cgroup_acl);
+		free(event->context);
 		free(event);
 	}
 }
@@ -872,6 +874,18 @@ int process_avc(auparse_state_t *au)
 		avc->comm = copy_str(auparse_interpret_field(au));
 	if (auparse_find_field(au, "name"))
 		avc->target = copy_str(auparse_interpret_field(au));
+
+	/* get the context related to the permission that was denied. */
+	if (avc->seperms) {
+		const char *ctx = NULL;
+		if (strcmp("relabelfrom", avc->seperms) == 0) {
+			ctx = auparse_find_field(au, "scontext");
+		} else if (strcmp("relabelto", avc->seperms) == 0) {
+			ctx = auparse_find_field(au, "tcontext");
+		}
+		avc->context = copy_str(ctx);
+	}
+
 	add_proof(avc, au);
 	if (list_append(events, avc) == NULL) {
 		event_free(avc);
@@ -1140,7 +1154,8 @@ void print_event(struct event *event)
 	} else if (event->type == ET_AVC) {
 		printf("\t%-12.12s", N(event->seperms));
 		printf("\t%-10.10s", N(event->seresult));
-		printf("\t%s\t%s", N(event->comm), N(event->target));
+		printf("\t%s\t%s\t%s", N(event->comm), N(event->target),
+				N(event->context));
 	}
 	printf("\n");
 
-- 
1.7.1

Re: [PATCH] auvirt: Add security context to "relabel{to, from}" AVC records

[Steve Grubb]

On Friday, February 10, 2012 08:58:07 AM Marcelo Cerri wrote:
> With this patch, auvirt prints one more field for AVC records when using
> the "--all-events" option. The target context is added to "relabelto" AVC
> records and the source context to "relabelfrom" AVC records.

Applied.

-Steve