RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-08 22:49:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

libselinux/utils: check for valid contexts to improve error causes

Browse Source 
Return more detailed error messages when the supplied contexts are
invalid.

Acked-by: James Carter <jwcart2@gmail.com>
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2022-04-05 15:26:30 +02:00 committed by James Carter
parent 20187dbfe9
commit 1020a5a248
7 changed files with 67 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libselinux/utils/compute_av.c
View File

@ -17,6 +17,16 @@ int main(int argc, char **argv)
exit(1);
}
if (security_check_context(argv[1])) {
fprintf(stderr, "%s: invalid source context '%s'\n", argv[0], argv[1]);
exit(4);
}
if (security_check_context(argv[2])) {
fprintf(stderr, "%s: invalid target context '%s'\n", argv[0], argv[2]);
exit(5);
}
tclass = string_to_security_class(argv[3]);
if (!tclass) {
fprintf(stderr, "%s: invalid class '%s'\n", argv[0], argv[3]);

12
libselinux/utils/compute_create.c
View File

@ -17,9 +17,19 @@ int main(int argc, char **argv)
exit(1);
}
if (security_check_context(argv[1])) {
fprintf(stderr, "%s: invalid source context '%s'\n", argv[0], argv[1]);
exit(4);
}
if (security_check_context(argv[2])) {
fprintf(stderr, "%s: invalid target context '%s'\n", argv[0], argv[2]);
exit(5);
}
tclass = string_to_security_class(argv[3]);
if (!tclass) {
fprintf(stderr, "Invalid class '%s'\n", argv[3]);
fprintf(stderr, "%s: invalid class '%s'\n", argv[0], argv[3]);
exit(2);
}

12
libselinux/utils/compute_member.c
View File

@ -17,9 +17,19 @@ int main(int argc, char **argv)
exit(1);
}
if (security_check_context(argv[1])) {
fprintf(stderr, "%s: invalid source context '%s'\n", argv[0], argv[1]);
exit(4);
}
if (security_check_context(argv[2])) {
fprintf(stderr, "%s: invalid target context '%s'\n", argv[0], argv[2]);
exit(5);
}
tclass = string_to_security_class(argv[3]);
if (!tclass) {
fprintf(stderr, "Invalid class '%s'\n", argv[3]);
fprintf(stderr, "%s: invalid class '%s'\n", argv[0], argv[3]);
exit(2);
}

10
libselinux/utils/compute_relabel.c
View File

@ -17,6 +17,16 @@ int main(int argc, char **argv)
exit(1);
}
if (security_check_context(argv[1])) {
fprintf(stderr, "%s: invalid source context '%s'\n", argv[0], argv[1]);
exit(4);
}
if (security_check_context(argv[2])) {
fprintf(stderr, "%s: invalid target context '%s'\n", argv[0], argv[2]);
exit(5);
}
tclass = string_to_security_class(argv[3]);
if (!tclass) {
fprintf(stderr, "%s: invalid class '%s'\n", argv[0], argv[3]);

5
libselinux/utils/getdefaultcon.c
View File

@ -68,6 +68,11 @@ int main(int argc, char **argv)
} else
cur_context = argv[optind + 1];
if (security_check_context(cur_context)) {
fprintf(stderr, "%s: invalid from context '%s'\n", argv[0], cur_context);
return 3;
}
if ((ret = getseuser(user, service, &seuser, &dlevel)) == 0) {
if (! level) level=dlevel;
if (role != NULL && role[0])

6
libselinux/utils/selinuxexeccon.c
View File

@ -16,7 +16,7 @@ static __attribute__ ((__noreturn__)) void usage(const char *name, const char *d
exit(rc);
}
static char * get_selinux_proc_context(const char *command, char * execcon) {
static char * get_selinux_proc_context(const char *command, const char * execcon) {
char * fcon = NULL, *newcon = NULL;
int ret = getfilecon(command, &fcon);
@ -43,6 +43,10 @@ int main(int argc, char **argv)
}
} else {
con = strdup(argv[2]);
if (security_check_context(con)) {
fprintf(stderr, "%s: invalid from context '%s'\n", argv[0], con);
return -1;
}
}
proccon = get_selinux_proc_context(argv[1], con);

15
libselinux/utils/validatetrans.c
View File

@ -17,12 +17,27 @@ int main(int argc, char **argv)
exit(1);
}
if (security_check_context(argv[1])) {
fprintf(stderr, "%s: invalid source context '%s'\n", argv[0], argv[1]);
exit(4);
}
if (security_check_context(argv[2])) {
fprintf(stderr, "%s: invalid target context '%s'\n", argv[0], argv[2]);
exit(5);
}
tclass = string_to_security_class(argv[3]);
if (!tclass) {
fprintf(stderr, "%s: invalid class '%s'\n", argv[0], argv[3]);
exit(2);
}
if (security_check_context(argv[4])) {
fprintf(stderr, "%s: invalid new context '%s'\n", argv[0], argv[4]);
exit(6);
}
ret = security_validatetrans(argv[1], argv[2], tclass, argv[4]);
printf("security_validatetrans returned %d errno: %s\n", ret, strerror(errno));