RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-16 02:10:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

libselinux - correct selabel invalid context logging

Browse Source 
When selabel_lookup found an invalid context with validation enabled, it
always stated it was 'file_contexts' whether media, x, db or file.
The fix is to store the spec file name in the selabel_lookup_rec on
selabel_open and use this as output for logs. Also a minor fix if key is
NULL to stop seg faults.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Richard Haines 2011-12-19 16:51:29 +00:00 committed by Eric Paris
parent c4c0748091
commit 16a37c9f94
7 changed files with 28 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libselinux/src/label.c
View File

@ -184,6 +184,12 @@ selabel_lookup_common(struct selabel_handle *rec, int translating,
const char *key, int type)
{
struct selabel_lookup_rec *lr;
if (key == NULL) {
errno = EINVAL;
return NULL;
}
char *ptr = selabel_sub(rec->subs, key);
if (ptr) {
lr = rec->func_lookup(rec, ptr, type);
@ -194,7 +200,7 @@ selabel_lookup_common(struct selabel_handle *rec, int translating,
if (!lr)
return NULL;
if (compat_validate(rec, lr, "file_contexts", 0))
if (compat_validate(rec, lr, rec->spec_file, 0))
return NULL;
if (translating && !lr->ctx_trans &&
@ -234,6 +240,7 @@ void selabel_close(struct selabel_handle *rec)
{
selabel_subs_fini(rec->subs);
rec->func_close(rec);
free(rec->spec_file);
free(rec);
}

5
libselinux/src/label_db.c
View File

@ -230,7 +230,7 @@ db_stats(struct selabel_handle *rec)
* selabel_open() handler
*/
static catalog_t *
db_init(struct selinux_opt *opts, unsigned nopts)
db_init(struct selinux_opt *opts, unsigned nopts, struct selabel_handle *rec)
{
catalog_t *catalog;
FILE *filp;
@ -275,6 +275,7 @@ db_init(struct selinux_opt *opts, unsigned nopts)
free(catalog);
return NULL;
}
rec->spec_file = strdup(path);
/*
* Parse for each lines
@ -332,7 +333,7 @@ int selabel_db_init(struct selabel_handle *rec,
rec->func_close = &db_close;
rec->func_lookup = &db_lookup;
rec->func_stats = &db_stats;
rec->data = db_init(opts, nopts);
rec->data = db_init(opts, nopts, rec);
return !rec->data ? -1 : 0;
}

1
libselinux/src/label_file.c
View File

@ -462,6 +462,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts,
if (localfp != NULL)
__fsetlocking(localfp, FSETLOCKING_BYCALLER);
}
rec->spec_file = strdup(path);
/*
* Perform two passes over the specification file.

6
libselinux/src/label_internal.h
View File

@ -59,6 +59,12 @@ struct selabel_handle {
/* supports backend-specific state information */
void *data;
/*
* The main spec file used. Note for file contexts the local and/or
* homedirs could also have been used to resolve a context.
*/
char *spec_file;
/* substitution support */
struct selabel_sub *subs;
};

1
libselinux/src/label_media.c
View File

@ -100,6 +100,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts,
errno = EINVAL;
return -1;
}
rec->spec_file = strdup(path);
/*
* Perform two passes over the specification file.

1
libselinux/src/label_x.c
View File

@ -127,6 +127,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts,
errno = EINVAL;
return -1;
}
rec->spec_file = strdup(path);
/*
* Perform two passes over the specification file.

11
libselinux/src/matchpathcon.c
View File

@ -531,9 +531,14 @@ int compat_validate(struct selabel_handle *rec,
else {
rc = selabel_validate(rec, contexts);
if (rc < 0) {
COMPAT_LOG(SELINUX_WARNING,
"%s: line %d has invalid context %s\n",
path, lineno, *ctx);
if (lineno) {
COMPAT_LOG(SELINUX_WARNING,
"%s: line %d has invalid context %s\n",
path, lineno, *ctx);
} else {
COMPAT_LOG(SELINUX_WARNING,
"%s: has invalid context %s\n", path, *ctx);
}
}
}