testing/libselinux
SHA256
3
0
Fork 0
forked from pool/libselinux
Code Pull Requests Activity

Accepting request 205373 from home:posophe:branches:security:SELinux

Browse Source 
- Update to version 2.2
  * Fix avc_has_perm() returns -1 even when SELinux is in permissive mode.
  * Support overriding Makefile RANLIB
  * Update pkgconfig definition
  * Mount sysfs before trying to mount selinuxfs.
  * Fix man pages
  * Support overriding PATH  and LIBBASE in Makefile
  * Fix LDFLAGS usage
  * Avoid shadowing stat in load_mmap
  * Support building on older PCRE libraries
  * Fix handling of temporary file in sefcontext_compile
  * Fix procattr cache
  * Define python constants for getenforce result
  * Fix label substitution handling of /
  * Add selinux_current_policy_path from
  * Change get_context_list to only return good matches
  * Support udev-197 and higher
  * Add support for local substitutions
  * Change setfilecon to not return ENOSUP if context is already correct
  * Python wrapper leak fixes
  * Export SELINUX_TRANS_DIR definition in selinux.h
  * Add selinux_systemd_contexts_path
  * Add selinux_set_policy_root
  * Add man page for sefcontext_compile
- Remove libselinux-rhat.patch; merged on upstream
- Adapt libselinux-ruby.patch to upstream changes
- Use fdupes to symlink duplicate manpages

OBS-URL: https://build.opensuse.org/request/show/205373
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libselinux?expand=0&rev=73
This commit is contained in:
Marcus Meissner 2013-11-07 10:18:12 +00:00 committed by Git OBS Bridge
parent d86c4f4446
commit 921d475c08
8 changed files with 79 additions and 773 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libselinux-2.1.13.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:57aad47c06b7ec18a76e8d9870539277a84cb40109cfdcf70ed3260bdb04447a
size 168931

6
libselinux-ruby.patch → libselinux-2.2-ruby.patch
View File

@ -2,7 +2,7 @@ Index: src/Makefile
===================================================================
--- src/Makefile.orig 2013-01-30 13:24:55.549631752 +0100
+++ src/Makefile 2013-01-30 13:25:56.148209843 +0100
@@ -16,8 +16,8 @@ PYINC ?= $(shell pkg-config --cflags $(P
@@ -16,8 +16,8 @@
PYLIBDIR ?= $(LIBDIR)/$(PYLIBVER)
RUBYLIBVER ?= $(shell $(RUBY) -e 'print RUBY_VERSION.split(".")[0..1].join(".")')
RUBYPLATFORM ?= $(shell $(RUBY) -e 'print RUBY_PLATFORM')
@ -10,9 +10,9 @@ Index: src/Makefile
-RUBYINSTALL ?= $(LIBDIR)/ruby/site_ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)
+RUBYINC ?= $(shell ruby -r rbconfig -e "print Config::CONFIG['rubyhdrdir'].nil? ? '$(LIBDIR)/ruby/$(RUBYLIBVER)' : Config::CONFIG['rubyhdrdir']")
+RUBYINSTALL ?= $(shell ruby -r rbconfig -e "print Config::CONFIG['vendorarchdir'].nil? ? '$(DESTDIR)'+Config::CONFIG['sitearchdir'] : '$(DESTDIR)'+Config::CONFIG['vendorarchdir']")
LIBBASE=$(shell basename $(LIBDIR))
LIBBASE ?= $(shell basename $(LIBDIR))
LDFLAGS ?= -lpcre -lpthread
VERSION = $(shell cat ../VERSION)
@@ -103,7 +103,7 @@ $(SWIGLOBJ): $(SWIGCOUT)
$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(PYINC) -fPIC -DSHARED -c -o $@ $<

3
libselinux-2.2.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e9dc64216543a7283d786f623ac28e8867f8794138e7deba474a3aa8d02dce33
size 171011

31
libselinux-bindings.changes
View File

@ -1,3 +1,34 @@
-------------------------------------------------------------------
Thu Oct 31 13:43:41 UTC 2013 - p.drouand@gmail.com
- Update to version 2.2
* Fix avc_has_perm() returns -1 even when SELinux is in permissive mode.
* Support overriding Makefile RANLIB
* Update pkgconfig definition
* Mount sysfs before trying to mount selinuxfs.
* Fix man pages
* Support overriding PATH and LIBBASE in Makefile
* Fix LDFLAGS usage
* Avoid shadowing stat in load_mmap
* Support building on older PCRE libraries
* Fix handling of temporary file in sefcontext_compile
* Fix procattr cache
* Define python constants for getenforce result
* Fix label substitution handling of /
* Add selinux_current_policy_path from
* Change get_context_list to only return good matches
* Support udev-197 and higher
* Add support for local substitutions
* Change setfilecon to not return ENOSUP if context is already correct
* Python wrapper leak fixes
* Export SELINUX_TRANS_DIR definition in selinux.h
* Add selinux_systemd_contexts_path
* Add selinux_set_policy_root
* Add man page for sefcontext_compile
- Remove libselinux-rhat.patch; merged on upstream
- Adapt libselinux-ruby.patch to upstream changes
- Use fdupes to symlink duplicate manpages
-------------------------------------------------------------------
Thu Jun 27 14:57:53 UTC 2013 - vcizek@suse.com

10
libselinux-bindings.spec
View File

@ -16,10 +16,10 @@
#
%define libsepol_ver 2.1.9
%define libsepol_ver 2.2
Name: libselinux-bindings
Version: 2.1.13
Version: 2.2
Release: 0
Url: http://userspace.selinuxproject.org/
Summary: SELinux library and simple utilities
@ -27,11 +27,10 @@ License: GPL-2.0 and SUSE-Public-Domain
Group: System/Libraries
# embedded is the MD5
Source: http://userspace.selinuxproject.org/releases/20130423/libselinux-%{version}.tar.gz
Source: http://userspace.selinuxproject.org/releases/20131030/libselinux-%{version}.tar.gz
Source1: selinux-ready
Source2: baselibs.conf
Patch0: libselinux-rhat.patch
Patch1: libselinux-ruby.patch
Patch1: libselinux-2.2-ruby.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: libsepol-devel-static >= %{libsepol_ver}
BuildRequires: pcre-devel
@ -106,7 +105,6 @@ decisions. Required for any applications that use the SELinux API.
%prep
%setup -q -n libselinux-%{version}
%patch0 -p2
%patch1
%build

755
libselinux-rhat.patch
View File

@ -1,755 +0,0 @@
diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
index a4079aa..0b122af 100644
--- a/libselinux/include/selinux/selinux.h
+++ b/libselinux/include/selinux/selinux.h
@@ -177,6 +177,7 @@ extern void selinux_set_callback(int type, union selinux_callback cb);
#define SELINUX_WARNING 1
#define SELINUX_INFO 2
#define SELINUX_AVC 3
+#define SELINUX_TRANS_DIR "/var/run/setrans"
/* Compute an access decision. */
extern int security_compute_av(const security_context_t scon,
@@ -496,8 +497,15 @@ extern int selinux_getpolicytype(char **policytype);
*/
extern const char *selinux_policy_root(void);
+/*
+ selinux_set_policy_root sets an alternate policy root directory path under
+ which the compiled policy file and context configuration files exist.
+ */
+extern int selinux_set_policy_root(const char *rootpath);
+
/* These functions return the paths to specific files under the
policy root directory. */
+extern const char *selinux_current_policy_path(void);
extern const char *selinux_binary_policy_path(void);
extern const char *selinux_failsafe_context_path(void);
extern const char *selinux_removable_context_path(void);
diff --git a/libselinux/man/man3/security_compute_av.3 b/libselinux/man/man3/security_compute_av.3
index c6837fc..de62d26 100644
--- a/libselinux/man/man3/security_compute_av.3
+++ b/libselinux/man/man3/security_compute_av.3
@@ -37,9 +37,9 @@ the SELinux policy database in the kernel
.sp
.BI "int security_compute_user_raw(security_context_t "scon ", const char *" username ", security_context_t **" con );
.sp
-.BI "int security_get_initial_context(const char *" name ", security_context_t " con );
+.BI "int security_get_initial_context(const char *" name ", security_context_t *" con );
.sp
-.BI "int security_get_initial_context_raw(const char *" name ", security_context_t " con );
+.BI "int security_get_initial_context_raw(const char *" name ", security_context_t *" con );
.sp
.BI "int selinux_check_access(const security_context_t " scon ", const security_context_t " tcon ", const char *" class ", const char *" perm ", void *" auditdata);
.sp
diff --git a/libselinux/man/man3/selinux_binary_policy_path.3 b/libselinux/man/man3/selinux_binary_policy_path.3
index ec97dcf..503c52c 100644
--- a/libselinux/man/man3/selinux_binary_policy_path.3
+++ b/libselinux/man/man3/selinux_binary_policy_path.3
@@ -1,6 +1,6 @@
.TH "selinux_binary_policy_path" "3" "15 November 2004" "dwalsh@redhat.com" "SELinux API Documentation"
.SH "NAME"
-selinux_path, selinux_policy_root, selinux_binary_policy_path,
+selinux_path, selinux_policy_root, selinux_binary_policy_path, selinux_current_policy_path,
selinux_failsafe_context_path, selinux_removable_context_path,
selinux_default_context_path, selinux_user_contexts_path,
selinux_file_context_path, selinux_media_context_path,
@@ -17,6 +17,8 @@ directories and files
.sp
.B const char *selinux_binary_policy_path(void);
.sp
+.B const char *selinux_current_policy_path(void);
+.sp
.B const char *selinux_failsafe_context_path(void);
.sp
.B const char *selinux_removable_context_path(void);
@@ -55,6 +57,9 @@ returns the top-level policy directory.
.BR selinux_binary_policy_path ()
returns the binary policy file loaded into kernel.
.sp
+.BR selinux_current_policy_path ()
+returns the currently loaded policy file from the kernel.
+.sp
.BR selinux_default_type_path ()
returns the context file mapping roles to default types.
.sp
diff --git a/libselinux/man/man3/selinux_current_policy_path.3 b/libselinux/man/man3/selinux_current_policy_path.3
new file mode 100644
index 0000000..175a611
--- /dev/null
+++ b/libselinux/man/man3/selinux_current_policy_path.3
@@ -0,0 +1 @@
+.so man3/selinux_binary_policy_path.3
diff --git a/libselinux/man/man3/selinux_policy_root.3 b/libselinux/man/man3/selinux_policy_root.3
index a6ccf86..63dc901 100644
--- a/libselinux/man/man3/selinux_policy_root.3
+++ b/libselinux/man/man3/selinux_policy_root.3
@@ -1,21 +1,34 @@
.TH "selinux_policy_root" "3" "25 May 2004" "dwalsh@redhat.com" "SELinux API documentation"
.SH "NAME"
selinux_policy_root \- return the path of the SELinux policy files for this machine
+selinux_set_policy_root \- Set an alternate SELinux root path for the SELinux policy files for this machine.
.
.SH "SYNOPSIS"
.B #include <selinux/selinux.h>
.sp
.B const char *selinux_policy_root(void);
.
+.sp
+.B int selinux_set_policy_root(const char *policypath);
+.
.SH "DESCRIPTION"
.BR selinux_policy_root ()
reads the contents of the
.I /etc/selinux/config
file to determine which policy files should be used for this machine.
.
+.BR selinux_set_policy_root ()
+sets up all all policy paths based on the alternate root
+
+.I /etc/selinux/config
+file to determine which policy files should be used for this machine.
+.
.SH "RETURN VALUE"
-On success, returns a directory path containing the SELinux policy files.
-On failure, NULL is returned.
+On success, selinux_policy_root returns a directory path containing the SELinux policy files.
+On failure, selinux_policy_root returns NULL.
+
+On success, selinux_set_policy_root returns 0 on success -1 on failure.
+
.
.SH "SEE ALSO"
.BR selinux "(8)"
diff --git a/libselinux/man/man3/selinux_set_policy_root.3 b/libselinux/man/man3/selinux_set_policy_root.3
new file mode 100644
index 0000000..8077658
--- /dev/null
+++ b/libselinux/man/man3/selinux_set_policy_root.3
@@ -0,0 +1 @@
+.so man3/selinux_policy_root.3
diff --git a/libselinux/man/man8/matchpathcon.8 b/libselinux/man/man8/matchpathcon.8
index 368991f..5d60789 100644
--- a/libselinux/man/man8/matchpathcon.8
+++ b/libselinux/man/man8/matchpathcon.8
@@ -13,6 +13,8 @@ matchpathcon \- get the default SELinux security context for the specified path
.IR file_contexts_file ]
.RB [ \-p
.IR prefix ]
+.RB [ \-P
+.IR policy_root_path ]
.I filepath...
.
.SH "DESCRIPTION"
@@ -46,6 +48,9 @@ Use alternate file_context file
.BI \-p " prefix"
Use prefix to speed translations
.TP
+.BI \-P " policy_root_path"
+Use alternate policy root path
+.TP
.B \-V
Verify file context on disk matches defaults
.
diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
index a328866..50868e4 100644
--- a/libselinux/man/man8/selinux.8
+++ b/libselinux/man/man8/selinux.8
@@ -37,20 +37,22 @@ The
configuration file also controls what policy
is active on the system. SELinux allows for multiple policies to be
installed on the system, but only one policy may be active at any
-given time. At present, two kinds of SELinux policy exist: targeted
-and strict. The targeted policy is designed as a policy where most
-processes operate without restrictions, and only specific services are
+given time. At present, multiple kinds of SELinux policy exist: targeted,
+mls for example. The targeted policy is designed as a policy where most
+user processes operate without restrictions, and only specific services are
placed into distinct security domains that are confined by the policy.
For example, the user would run in a completely unconfined domain
while the named daemon or apache daemon would run in a specific domain
-tailored to its operation. The strict policy is designed as a policy
-where all processes are partitioned into fine-grained security domains
-and confined by policy. It is anticipated in the future that other
-policies will be created (Multi-Level Security for example). You can
+tailored to its operation. The MLS (Multi-Level Security) policy is designed
+as a policy where all processes are partitioned into fine-grained security
+domains and confined by policy. MLS also supports the Bell And LaPadula model, where processes are not only confined by the type but also the level of the data.
+
+You can
define which policy you will run by setting the
.B SELINUXTYPE
environment variable within
.IR /etc/selinux/config .
+You must reboot and possibly relabel if you change the policy type to have it take effect on the system.
The corresponding
policy configuration for each such policy must be installed in the
.I /etc/selinux/{SELINUXTYPE}/
@@ -58,7 +60,7 @@ directories.
A given SELinux policy can be customized further based on a set of
compile-time tunable options and a set of runtime policy booleans.
-.B \%system\-config\-securitylevel
+.B \%system\-config\-selinux
allows customization of these booleans and tunables.
Many domains that are protected by SELinux also include SELinux man pages explaining how to customize their policy.
@@ -86,11 +88,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.nh
.BR booleans (8),
.BR setsebool (8),
-.BR selinuxenabled (8),
+.BR sepolicy (8),
+.BR system-config-selinux (8),
.BR togglesebool (8),
.BR restorecon (8),
+.BR fixfiles (8),
.BR setfiles (8),
-.BR semange (8),
+.BR semanage (8),
.BR sepolicy(8)
Every confined service on the system has a man page in the following format:
diff --git a/libselinux/src/audit2why.c b/libselinux/src/audit2why.c
index ffe381b..560bc25 100644
--- a/libselinux/src/audit2why.c
+++ b/libselinux/src/audit2why.c
@@ -210,27 +210,12 @@ static int __policy_init(const char *init_path)
return 1;
}
} else {
- vers = sepol_policy_kern_vers_max();
- if (vers < 0) {
- snprintf(errormsg, sizeof(errormsg),
- "Could not get policy version: %s\n",
- strerror(errno));
- PyErr_SetString( PyExc_ValueError, errormsg);
- return 1;
- }
- snprintf(path, PATH_MAX, "%s.%d",
- selinux_binary_policy_path(), vers);
- fp = fopen(path, "r");
- while (!fp && errno == ENOENT && --vers) {
- snprintf(path, PATH_MAX, "%s.%d",
- selinux_binary_policy_path(), vers);
- fp = fopen(path, "r");
- }
+ fp = fopen(selinux_current_policy_path(), "r");
if (!fp) {
snprintf(errormsg, sizeof(errormsg),
- "unable to open %s.%d: %s\n",
- selinux_binary_policy_path(),
- security_policyvers(), strerror(errno));
+ "unable to open %s: %s\n",
+ selinux_current_policy_path(),
+ strerror(errno));
PyErr_SetString( PyExc_ValueError, errormsg);
return 1;
}
@@ -310,10 +295,12 @@ static PyObject *init(PyObject *self __attribute__((unused)), PyObject *args) {
}
#define RETURN(X) \
- PyTuple_SetItem(result, 0, Py_BuildValue("i", X)); \
- return result;
+ { \
+ return Py_BuildValue("iO", (X), Py_None); \
+ }
static PyObject *analyze(PyObject *self __attribute__((unused)) , PyObject *args) {
+ char *reason_buf = NULL;
security_context_t scon;
security_context_t tcon;
char *tclassstr;
@@ -328,10 +315,6 @@ static PyObject *analyze(PyObject *self __attribute__((unused)) , PyObject *args
struct sepol_av_decision avd;
int rc;
int i=0;
- PyObject *result = PyTuple_New(2);
- if (!result) return NULL;
- Py_INCREF(Py_None);
- PyTuple_SetItem(result, 1, Py_None);
if (!PyArg_ParseTuple(args,(char *)"sssO!:audit2why",&scon,&tcon,&tclassstr,&PyList_Type, &listObj))
return NULL;
@@ -342,22 +325,21 @@ static PyObject *analyze(PyObject *self __attribute__((unused)) , PyObject *args
/* should raise an error here. */
if (numlines < 0) return NULL; /* Not a list */
- if (!avc) {
+ if (!avc)
RETURN(NOPOLICY)
- }
rc = sepol_context_to_sid(scon, strlen(scon) + 1, &ssid);
- if (rc < 0) {
+ if (rc < 0)
RETURN(BADSCON)
- }
+
rc = sepol_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
- if (rc < 0) {
+ if (rc < 0)
RETURN(BADTCON)
- }
+
tclass = string_to_security_class(tclassstr);
- if (!tclass) {
+ if (!tclass)
RETURN(BADTCLASS)
- }
+
/* Convert the permission list to an AV. */
av = 0;
@@ -377,21 +359,20 @@ static PyObject *analyze(PyObject *self __attribute__((unused)) , PyObject *args
#endif
perm = string_to_av_perm(tclass, permstr);
- if (!perm) {
+ if (!perm)
RETURN(BADPERM)
- }
+
av |= perm;
}
/* Reproduce the computation. */
- rc = sepol_compute_av_reason(ssid, tsid, tclass, av, &avd, &reason);
- if (rc < 0) {
+ rc = sepol_compute_av_reason_buffer(ssid, tsid, tclass, av, &avd, &reason, &reason_buf, 0);
+ if (rc < 0)
RETURN(BADCOMPUTE)
- }
- if (!reason) {
+ if (!reason)
RETURN(ALLOW)
- }
+
if (reason & SEPOL_COMPUTEAV_TE) {
avc->ssid = ssid;
avc->tsid = tsid;
@@ -404,28 +385,34 @@ static PyObject *analyze(PyObject *self __attribute__((unused)) , PyObject *args
RETURN(TERULE)
}
} else {
- PyTuple_SetItem(result, 0, Py_BuildValue("i", BOOLEAN));
+ PyObject *outboollist;
struct boolean_t *b = bools;
int len=0;
while (b->name) {
len++; b++;
}
b = bools;
- PyObject *outboollist = PyTuple_New(len);
+ outboollist = PyList_New(len);
len=0;
while(b->name) {
- PyObject *bool = Py_BuildValue("(si)", b->name, b->active);
- PyTuple_SetItem(outboollist, len++, bool);
+ PyObject *bool_ = Py_BuildValue("(si)", b->name, b->active);
+ PyList_SetItem(outboollist, len++, bool_);
b++;
}
free(bools);
- PyTuple_SetItem(result, 1, outboollist);
- return result;
+ /* 'N' steals the reference to outboollist */
+ return Py_BuildValue("iN", BOOLEAN, outboollist);
}
}
if (reason & SEPOL_COMPUTEAV_CONS) {
- RETURN(CONSTRAINT);
+ if (reason_buf) {
+ PyObject *result = NULL;
+ result = Py_BuildValue("is", CONSTRAINT, reason_buf);
+ free(reason_buf);
+ return result;
+ }
+ RETURN(CONSTRAINT)
}
if (reason & SEPOL_COMPUTEAV_RBAC)
diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
index 802a07f..6ff83a7 100644
--- a/libselinux/src/avc.c
+++ b/libselinux/src/avc.c
@@ -827,6 +827,7 @@ int avc_has_perm(security_id_t ssid, security_id_t tsid,
errsave = errno;
avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
errno = errsave;
+ if (!avc_enforcing) return 0;
return rc;
}
diff --git a/libselinux/src/get_context_list.c b/libselinux/src/get_context_list.c
index b9e8002..355730a 100644
--- a/libselinux/src/get_context_list.c
+++ b/libselinux/src/get_context_list.c
@@ -426,7 +426,7 @@ int get_ordered_context_list(const char *user,
/* Initialize ordering array. */
ordering = malloc(nreach * sizeof(unsigned int));
if (!ordering)
- goto oom_order;
+ goto failsafe;
for (i = 0; i < nreach; i++)
ordering[i] = nreach;
@@ -435,7 +435,7 @@ int get_ordered_context_list(const char *user,
fname_len = strlen(user_contexts_path) + strlen(user) + 2;
fname = malloc(fname_len);
if (!fname)
- goto oom_order;
+ goto failsafe;
snprintf(fname, fname_len, "%s%s", user_contexts_path, user);
fp = fopen(fname, "r");
if (fp) {
@@ -465,31 +465,28 @@ int get_ordered_context_list(const char *user,
}
}
+ if (!nordered)
+ goto failsafe;
+
/* Apply the ordering. */
- if (nordered) {
- co = malloc(nreach * sizeof(struct context_order));
- if (!co)
- goto oom_order;
- for (i = 0; i < nreach; i++) {
- co[i].con = reachable[i];
- co[i].order = ordering[i];
- }
- qsort(co, nreach, sizeof(struct context_order), order_compare);
- for (i = 0; i < nreach; i++)
- reachable[i] = co[i].con;
- free(co);
+ co = malloc(nreach * sizeof(struct context_order));
+ if (!co)
+ goto failsafe;
+ for (i = 0; i < nreach; i++) {
+ co[i].con = reachable[i];
+ co[i].order = ordering[i];
}
+ qsort(co, nreach, sizeof(struct context_order), order_compare);
+ for (i = 0; i < nreach; i++)
+ reachable[i] = co[i].con;
+ free(co);
- /* Return the ordered list.
- If we successfully ordered it, then only report the ordered entries
- to the caller. Otherwise, fall back to the entire reachable list. */
- if (nordered && nordered < nreach) {
+ /* Only report the ordered entries to the caller. */
+ if (nordered < nreach) {
for (i = nordered; i < nreach; i++)
free(reachable[i]);
reachable[nordered] = NULL;
rc = nordered;
- } else {
- rc = nreach;
}
out:
@@ -523,14 +520,6 @@ int get_ordered_context_list(const char *user,
}
rc = 1; /* one context in the list */
goto out;
-
- oom_order:
- /* Unable to order context list due to OOM condition.
- Fall back to unordered reachable context list. */
- fprintf(stderr, "%s: out of memory, unable to order list\n",
- __FUNCTION__);
- rc = nreach;
- goto out;
}
hidden_def(get_ordered_context_list)
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index 5f697f3..9b0d6b0 100644
--- a/libselinux/src/label_file.c
+++ b/libselinux/src/label_file.c
@@ -649,6 +649,8 @@ static struct selabel_lookup_rec *lookup(struct selabel_handle *rec,
break;
} else if (rc == PCRE_ERROR_NOMATCH)
continue;
+
+ errno = ENOENT;
/* else it's an error */
goto finish;
}
@@ -660,6 +662,7 @@ static struct selabel_lookup_rec *lookup(struct selabel_handle *rec,
goto finish;
}
+ errno = 0;
ret = &spec_arr[i].lr;
finish:
diff --git a/libselinux/src/matchpathcon.c b/libselinux/src/matchpathcon.c
index 2d7369e..2a00807 100644
--- a/libselinux/src/matchpathcon.c
+++ b/libselinux/src/matchpathcon.c
@@ -2,6 +2,7 @@
#include <string.h>
#include <errno.h>
#include <stdio.h>
+#include <syslog.h>
#include "selinux_internal.h"
#include "label_internal.h"
#include "callbacks.h"
@@ -62,7 +63,7 @@ static void
{
va_list ap;
va_start(ap, fmt);
- vfprintf(stderr, fmt, ap);
+ vsyslog(LOG_ERR, fmt, ap);
va_end(ap);
}
diff --git a/libselinux/src/procattr.c b/libselinux/src/procattr.c
index 6c5b45a..0a0dd3e 100644
--- a/libselinux/src/procattr.c
+++ b/libselinux/src/procattr.c
@@ -257,6 +257,7 @@ out:
free(context);
return -1;
} else {
+ free(*prev_context);
*prev_context = context;
return 0;
}
diff --git a/libselinux/src/selinux_config.c b/libselinux/src/selinux_config.c
index 296f357..0040524 100644
--- a/libselinux/src/selinux_config.c
+++ b/libselinux/src/selinux_config.c
@@ -8,6 +8,8 @@
#include <limits.h>
#include <unistd.h>
#include <pthread.h>
+#include <errno.h>
+#include "policy.h"
#include "selinux_internal.h"
#include "get_default_type_internal.h"
@@ -138,6 +140,13 @@ int selinux_getpolicytype(char **type)
hidden_def(selinux_getpolicytype)
+static int setpolicytype(const char *type)
+{
+ free(selinux_policytype);
+ selinux_policytype = strdup(type);
+ return selinux_policytype ? 0 : -1;
+}
+
static char *selinux_policyroot = NULL;
static const char *selinux_rootpath = SELINUXDIR;
@@ -261,6 +270,37 @@ const char *selinux_policy_root(void)
return selinux_policyroot;
}
+int selinux_set_policy_root(const char *path)
+{
+ int i;
+ char *policy_type = strchr(selinux_policyroot, '/');
+ if (!policy_type) {
+ errno = EINVAL;
+ return -1;
+ }
+ policy_type++;
+
+ fini_selinuxmnt();
+ fini_selinux_policyroot();
+
+ selinux_policyroot = strdup(path);
+ if (! selinux_policyroot)
+ return -1;
+
+ if (setpolicytype(policy_type) != 0)
+ return -1;
+
+ for (i = 0; i < NEL; i++)
+ if (asprintf(&file_paths[i], "%s%s",
+ selinux_policyroot,
+ file_path_suffixes_data.str +
+ file_path_suffixes_idx[i])
+ == -1)
+ return -1;
+
+ return 0;
+}
+
const char *selinux_path(void)
{
return selinux_rootpath;
@@ -303,6 +343,31 @@ const char *selinux_binary_policy_path(void)
hidden_def(selinux_binary_policy_path)
+const char *selinux_current_policy_path(void)
+{
+ int rc = 0;
+ int vers = 0;
+ static char policy_path[PATH_MAX];
+
+ if (selinux_mnt) {
+ snprintf(policy_path, sizeof(policy_path), "%s/policy", selinux_mnt);
+ if (access(policy_path, F_OK) == 0 ) {
+ return policy_path;
+ }
+ }
+ vers = security_policyvers();
+ do {
+ /* Check prior versions to see if old policy is available */
+ snprintf(policy_path, sizeof(policy_path), "%s.%d",
+ selinux_binary_policy_path(), vers);
+ } while ((rc = access(policy_path, F_OK)) && --vers > 0);
+
+ if (rc) return NULL;
+ return policy_path;
+}
+
+hidden_def(selinux_current_policy_path)
+
const char *selinux_file_context_path(void)
{
return get_path(FILE_CONTEXTS);
diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h
index 2c7c85c..4a4aebc 100644
--- a/libselinux/src/selinux_internal.h
+++ b/libselinux/src/selinux_internal.h
@@ -60,6 +60,7 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(security_setenforce)
hidden_proto(security_deny_unknown)
hidden_proto(selinux_boolean_sub)
+ hidden_proto(selinux_current_policy_path)
hidden_proto(selinux_binary_policy_path)
hidden_proto(selinux_booleans_subs_path)
hidden_proto(selinux_default_context_path)
diff --git a/libselinux/src/setrans_internal.h b/libselinux/src/setrans_internal.h
index a801ee8..b3bdca2 100644
--- a/libselinux/src/setrans_internal.h
+++ b/libselinux/src/setrans_internal.h
@@ -1,6 +1,7 @@
/* Author: Trusted Computer Solutions, Inc. */
+#include <selinux/selinux.h>
-#define SETRANS_UNIX_SOCKET "/var/run/setrans/.setrans-unix"
+#define SETRANS_UNIX_SOCKET SELINUX_TRANS_DIR "/.setrans-unix"
#define RAW_TO_TRANS_CONTEXT 2
#define TRANS_TO_RAW_CONTEXT 3
diff --git a/libselinux/utils/matchpathcon.c b/libselinux/utils/matchpathcon.c
index dd5aaa3..9d3ff3a 100644
--- a/libselinux/utils/matchpathcon.c
+++ b/libselinux/utils/matchpathcon.c
@@ -12,11 +12,10 @@
#include <limits.h>
#include <stdlib.h>
-
static void usage(const char *progname)
{
fprintf(stderr,
- "usage: %s [-N] [-n] [-f file_contexts] [-p prefix] [-Vq] path...\n",
+ "usage: %s [-N] [-n] [-f file_contexts] [ -P policy_root_path ] [-p prefix] [-Vq] path...\n",
progname);
exit(1);
}
@@ -78,7 +77,7 @@ int main(int argc, char **argv)
if (argc < 2)
usage(argv[0]);
- while ((opt = getopt(argc, argv, "m:Nnf:p:Vq")) > 0) {
+ while ((opt = getopt(argc, argv, "m:Nnf:P:p:Vq")) > 0) {
switch (opt) {
case 'n':
header = 0;
@@ -113,6 +112,15 @@ int main(int argc, char **argv)
exit(1);
}
break;
+ case 'P':
+ if (selinux_set_policy_root(optarg) < 0 ) {
+ fprintf(stderr,
+ "Error setting policy root %s: %s\n",
+ optarg,
+ errno ? strerror(errno) : "invalid");
+ exit(1);
+ }
+ break;
case 'p':
if (init) {
fprintf(stderr,
diff --git a/libselinux/utils/sefcontext_compile.c b/libselinux/utils/sefcontext_compile.c
index 6f79dd6..e019a07 100644
--- a/libselinux/utils/sefcontext_compile.c
+++ b/libselinux/utils/sefcontext_compile.c
@@ -145,7 +145,7 @@ static int process_file(struct saved_data *data, const char *filename)
* u32 - data length of the pcre regex study daya
* char - a buffer holding the raw pcre regex study data
*/
-static int write_binary_file(struct saved_data *data, char *filename)
+static int write_binary_file(struct saved_data *data, int fd)
{
struct spec *specs = data->spec_arr;
FILE *bin_file;
@@ -155,7 +155,7 @@ static int write_binary_file(struct saved_data *data, char *filename)
uint32_t i;
int rc;
- bin_file = fopen(filename, "w");
+ bin_file = fdopen(fd, "w");
if (!bin_file) {
perror("fopen output_file");
exit(EXIT_FAILURE);
@@ -321,7 +321,9 @@ int main(int argc, char *argv[])
const char *path;
char stack_path[PATH_MAX + 1];
int rc;
-
+ char *tmp= NULL;
+ int fd;
+
if (argc != 2) {
fprintf(stderr, "usage: %s input_file\n", argv[0]);
exit(EXIT_FAILURE);
@@ -342,13 +344,29 @@ int main(int argc, char *argv[])
rc = snprintf(stack_path, sizeof(stack_path), "%s.bin", path);
if (rc < 0 || rc >= sizeof(stack_path))
return rc;
- rc = write_binary_file(&data, stack_path);
+
+ if (asprintf(&tmp, "%sXXXXXX", stack_path) < 0)
+ return -1;
+
+ fd = mkstemp(tmp);
+ if (fd < 0)
+ goto err;
+
+ rc = write_binary_file(&data, fd);
+
if (rc < 0)
- return rc;
+ goto err;
+ rename(tmp, stack_path);
rc = free_specs(&data);
if (rc < 0)
- return rc;
+ goto err;
- return 0;
+ rc = 0;
+out:
+ free(tmp);
+ return rc;
+err:
+ rc = -1;
+ goto out;
}

31
libselinux.changes
View File

@ -1,3 +1,34 @@
-------------------------------------------------------------------
Thu Oct 31 13:43:41 UTC 2013 - p.drouand@gmail.com
- Update to version 2.2
* Fix avc_has_perm() returns -1 even when SELinux is in permissive mode.
* Support overriding Makefile RANLIB
* Update pkgconfig definition
* Mount sysfs before trying to mount selinuxfs.
* Fix man pages
* Support overriding PATH and LIBBASE in Makefile
* Fix LDFLAGS usage
* Avoid shadowing stat in load_mmap
* Support building on older PCRE libraries
* Fix handling of temporary file in sefcontext_compile
* Fix procattr cache
* Define python constants for getenforce result
* Fix label substitution handling of /
* Add selinux_current_policy_path from
* Change get_context_list to only return good matches
* Support udev-197 and higher
* Add support for local substitutions
* Change setfilecon to not return ENOSUP if context is already correct
* Python wrapper leak fixes
* Export SELINUX_TRANS_DIR definition in selinux.h
* Add selinux_systemd_contexts_path
* Add selinux_set_policy_root
* Add man page for sefcontext_compile
- Remove libselinux-rhat.patch; merged on upstream
- Adapt libselinux-ruby.patch to upstream changes
- Use fdupes to symlink duplicate manpages
-------------------------------------------------------------------
Thu Jun 27 14:42:01 UTC 2013 - vcizek@suse.com

13
libselinux.spec
View File

@ -16,22 +16,22 @@
#
%define libsepol_ver 2.1.9
%define libsepol_ver 2.2
Name: libselinux
Version: 2.1.13
Version: 2.2
Release: 0
Url: http://userspace.selinuxproject.org/
Summary: SELinux library and simple utilities
License: GPL-2.0 and SUSE-Public-Domain
Group: System/Libraries
Source: http://userspace.selinuxproject.org/releases/20130423/%{name}-%{version}.tar.gz
Source: http://userspace.selinuxproject.org/releases/20131030/%{name}-%{version}.tar.gz
Source1: selinux-ready
Source2: baselibs.conf
Patch0: %{name}-rhat.patch
Patch1: %{name}-ruby.patch
Patch1: %{name}-2.2-ruby.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: fdupes
BuildRequires: libsepol-devel >= %{libsepol_ver}
BuildRequires: pcre-devel
BuildRequires: pkg-config
@ -119,7 +119,6 @@ necessary to develop your own software using libselinux.
%prep
%setup -q
%patch0 -p2
%patch1
%build
@ -147,6 +146,8 @@ rm -f $RPM_BUILD_ROOT%{_sbindir}/selinux_check_securetty_context
mv $RPM_BUILD_ROOT%{_sbindir}/getdefaultcon $RPM_BUILD_ROOT%{_sbindir}/selinuxdefcon
mv $RPM_BUILD_ROOT%{_sbindir}/getconlist $RPM_BUILD_ROOT%{_sbindir}/selinuxconlist
install -m 0755 %{SOURCE1} $RPM_BUILD_ROOT%{_sbindir}/selinux-ready
# Remove duplicate files
%fdupes -s %{buildroot}%{_mandir}
%post -n libselinux1 -p /sbin/ldconfig