RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixfiles: Unmount temporary bind mounts on SIGINT 

`fixfiles -M relabel` temporary bind mounts file systems before
relabeling, but it left the / directory mounted in /tmp/tmp.XXXX when a
user hit CTRL-C. It means that if the user run `fixfiles -M relabel`
again and answered Y to clean out /tmp directory, it would remove all
data from mounted fs.

This patch changes the location where `fixfiles` mounts fs to /run, uses
private mount namespace via unshare and adds a handler for exit signals
which tries to umount fs mounted by `fixfiles`.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2125355

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Tested-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
Petr Lautrbach 2022-11-07 10:25:05 +01:00 committed by James Carter
parent 4beba554f0
commit 25d7941aee
1 changed files with 28 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
policycoreutils/scripts/fixfiles
View File

@ -207,6 +207,25 @@ rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr [ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr
} }
# unmount tmp bind mount before exit
umount_TMP_MOUNT() {
if [ -n "$TMP_MOUNT" ]; then
umount "${TMP_MOUNT}${m}" || exit 130
rm -rf "${TMP_MOUNT}" || echo "Error cleaning up."
fi
exit 130
}
fix_labels_on_mountpoint() {
test -z ${TMP_MOUNT+x} && echo "Unable to find temporary directory!" && exit 1
mkdir -p "${TMP_MOUNT}${m}" || exit 1
mount --bind "${m}" "${TMP_MOUNT}${m}" || exit 1
${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}"
umount "${TMP_MOUNT}${m}" || exit 1
rm -rf "${TMP_MOUNT}" || echo "Error cleaning up."
}
export -f fix_labels_on_mountpoint
# #
# restore # restore
# if called with -n will only check file context # if called with -n will only check file context
@ -252,14 +271,15 @@ case "$RESTORE_MODE" in
# we bind mount so we can fix the labels of files that have already been # we bind mount so we can fix the labels of files that have already been
# mounted over # mounted over
for m in `echo $FILESYSTEMSRW`; do for m in `echo $FILESYSTEMSRW`; do
TMP_MOUNT="$(mktemp -d)" TMP_MOUNT="$(mktemp -p /run -d fixfiles.XXXXXXXXXX)"
test -z ${TMP_MOUNT+x} && echo "Unable to find temporary directory!" && exit 1 export SETFILES VERBOSE EXCLUDEDIRS FORCEFLAG THREADS FC TMP_MOUNT m
if type unshare &> /dev/null; then
mkdir -p "${TMP_MOUNT}${m}" || exit 1 unshare -m bash -c "fix_labels_on_mountpoint $*" || exit $?
mount --bind "${m}" "${TMP_MOUNT}${m}" || exit 1 else
${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}" trap umount_TMP_MOUNT EXIT
umount "${TMP_MOUNT}${m}" || exit 1 fix_labels_on_mountpoint $*
rm -rf "${TMP_MOUNT}" || echo "Error cleaning up." trap EXIT
fi
done; done;
fi fi
else else