libsemanage: maintain disable dontaudit state between handle commits

Currently any changes made to the policy which require committing a handle cause dontaudit rules to be re-enabled. This is confusing, and frustrating for users who want to edit policy with dontaudit rules turned off. This patch allows semanage to remember the last state of the dontaudit rules and apply them as default whenever a handle is connected. Additionally other functions may check for the file semanage creates to determine if dontaudit rules are turned on. This knowledge can be useful for tools like SETroubleshoot which may want to change their behavior depending on the state of the dontaudit rules. In the event that a the file cannot be created a call to commit will fail.

Signed-off-by: Christopher Pardy <cpardy@redhat.com>

[sds:  Removed duplicate from other patch and cleaned up style.]
[sds:  Changed uses of semanage_fname to semanage_path.]
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
Christopher Pardy 2009-07-07 13:32:48 -04:00 committed by Stephen Smalley
parent 86a2f899cb
commit 200efad4cb
6 changed files with 44 additions and 2 deletions

View File

@ -69,6 +69,9 @@ void semanage_set_rebuild(semanage_handle_t * handle, int do_rebuild);
* 1 for yes, 0 for no (default) */ * 1 for yes, 0 for no (default) */
void semanage_set_create_store(semanage_handle_t * handle, int create_store); void semanage_set_create_store(semanage_handle_t * handle, int create_store);
/*Get whether or not dontaudits will be disabled upon commit */
int semanage_get_disable_dontaudit(semanage_handle_t * handle);
/* Set whether or not to disable dontaudits upon commit */ /* Set whether or not to disable dontaudits upon commit */
void semanage_set_disable_dontaudit(semanage_handle_t * handle, int disable_dontaudit); void semanage_set_disable_dontaudit(semanage_handle_t * handle, int disable_dontaudit);

View File

@ -20,6 +20,7 @@
*/ */
#include <sepol/module.h> #include <sepol/module.h>
#include <sepol/handle.h>
#include <selinux/selinux.h> #include <selinux/selinux.h>
#include <assert.h> #include <assert.h>
@ -111,6 +112,7 @@ int semanage_direct_is_managed(semanage_handle_t * sh)
int semanage_direct_connect(semanage_handle_t * sh) int semanage_direct_connect(semanage_handle_t * sh)
{ {
char polpath[PATH_MAX]; char polpath[PATH_MAX];
const char *path;
snprintf(polpath, PATH_MAX, "%s%s", selinux_path(), snprintf(polpath, PATH_MAX, "%s%s", selinux_path(),
sh->conf->store_path); sh->conf->store_path);
@ -223,6 +225,13 @@ int semanage_direct_connect(semanage_handle_t * sh)
if (bool_activedb_dbase_init(sh, semanage_bool_dbase_active(sh)) < 0) if (bool_activedb_dbase_init(sh, semanage_bool_dbase_active(sh)) < 0)
goto err; goto err;
/* set the disable dontaudit value */
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_DISABLE_DONTAUDIT);
if (access(path, F_OK) == 0)
sepol_set_disable_dontaudit(sh->sepolh, 1);
else
sepol_set_disable_dontaudit(sh->sepolh, 0);
return STATUS_SUCCESS; return STATUS_SUCCESS;
err: err:
@ -645,7 +654,7 @@ static int semanage_direct_commit(semanage_handle_t * sh)
char **mod_filenames = NULL; char **mod_filenames = NULL;
char *sorted_fc_buffer = NULL, *sorted_nc_buffer = NULL; char *sorted_fc_buffer = NULL, *sorted_nc_buffer = NULL;
size_t sorted_fc_buffer_len = 0, sorted_nc_buffer_len = 0; size_t sorted_fc_buffer_len = 0, sorted_nc_buffer_len = 0;
const char *linked_filename = NULL, *ofilename = NULL; const char *linked_filename = NULL, *ofilename = NULL, *path;
sepol_module_package_t *base = NULL; sepol_module_package_t *base = NULL;
int retval = -1, num_modfiles = 0, i; int retval = -1, num_modfiles = 0, i;
sepol_policydb_t *out = NULL; sepol_policydb_t *out = NULL;
@ -669,6 +678,27 @@ static int semanage_direct_commit(semanage_handle_t * sh)
dbase_config_t *pfcontexts = semanage_fcontext_dbase_policy(sh); dbase_config_t *pfcontexts = semanage_fcontext_dbase_policy(sh);
dbase_config_t *seusers = semanage_seuser_dbase_local(sh); dbase_config_t *seusers = semanage_seuser_dbase_local(sh);
/* Create or remove the disable_dontaudit flag file. */
path = semanage_path(SEMANAGE_TMP, SEMANAGE_DISABLE_DONTAUDIT);
if (sepol_get_disable_dontaudit(sh->sepolh) == 1) {
FILE *touch;
touch = fopen(path, "w");
if (touch != NULL) {
if (fclose(touch) != 0) {
ERR(sh, "Error attempting to create disable_dontaudit flag.");
goto cleanup;
}
} else {
ERR(sh, "Error attempting to create disable_dontaudit flag.");
goto cleanup;
}
} else {
if (remove(path) == -1 && errno != ENOENT) {
ERR(sh, "Error removing the disable_dontaudit flag.");
goto cleanup;
}
}
/* Before we do anything else, flush the join to its component parts. /* Before we do anything else, flush the join to its component parts.
* This *does not* flush to disk automatically */ * This *does not* flush to disk automatically */
if (users->dtable->is_modified(users->dbase)) { if (users->dtable->is_modified(users->dbase)) {

View File

@ -110,6 +110,13 @@ void semanage_set_create_store(semanage_handle_t * sh, int create_store)
return; return;
} }
int semanage_get_disable_dontaudit(semanage_handle_t * sh)
{
assert(sh != NULL);
return sepol_get_disable_dontaudit(sh->sepolh);
}
void semanage_set_disable_dontaudit(semanage_handle_t * sh, int disable_dontaudit) void semanage_set_disable_dontaudit(semanage_handle_t * sh, int disable_dontaudit)
{ {
assert(sh != NULL); assert(sh != NULL);

View File

@ -15,7 +15,7 @@ LIBSEMANAGE_1.0 {
semanage_iface_*; semanage_port_*; semanage_context_*; semanage_iface_*; semanage_port_*; semanage_context_*;
semanage_node_*; semanage_node_*;
semanage_fcontext_*; semanage_access_check; semanage_set_create_store; semanage_fcontext_*; semanage_access_check; semanage_set_create_store;
semanage_is_connected; semanage_set_disable_dontaudit; semanage_is_connected; semanage_get_disable_dontaudit; semanage_set_disable_dontaudit;
semanage_mls_enabled; semanage_mls_enabled;
local: *; local: *;
}; };

View File

@ -114,6 +114,7 @@ static const char *semanage_sandbox_paths[SEMANAGE_STORE_NUM_PATHS] = {
"/users_extra", "/users_extra",
"/netfilter_contexts", "/netfilter_contexts",
"/file_contexts.homedirs", "/file_contexts.homedirs",
"/disable_dontaudit",
}; };
/* A node used in a linked list of file contexts; used for sorting. /* A node used in a linked list of file contexts; used for sorting.

View File

@ -58,6 +58,7 @@ enum semanage_sandbox_defs {
SEMANAGE_USERS_EXTRA, SEMANAGE_USERS_EXTRA,
SEMANAGE_NC, SEMANAGE_NC,
SEMANAGE_FC_HOMEDIRS, SEMANAGE_FC_HOMEDIRS,
SEMANAGE_DISABLE_DONTAUDIT,
SEMANAGE_STORE_NUM_PATHS SEMANAGE_STORE_NUM_PATHS
}; };