RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-05-07 18:18:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

policycoreutils: setfiles: move exclude_non_seclabel_mounts to a generic location

Browse Source 
move exclude_non_seclabel_mounts from setfiles.c to restore.c so it can
be used by other functions later.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Eric Paris 2011-07-10 16:46:38 +02:00
parent 142209161f
commit 5ffa296798
3 changed files with 63 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
policycoreutils/setfiles/restore.c
View File

@ -631,5 +631,67 @@ static int filespec_add(ino_t ino, const security_context_t con, const char *fil
return -1; return -1;
} }
#include <sys/utsname.h>
/*
Search /proc/mounts for all file systems that do not support extended
attributes and add them to the exclude directory table. File systems
that support security labels have the seclabel option.
*/
void exclude_non_seclabel_mounts()
{
struct utsname uts;
FILE *fp;
size_t len;
ssize_t num;
int index = 0, found = 0;
char *mount_info[4];
char *buf = NULL, *item;
/* Check to see if the kernel supports seclabel */
if (uname(&uts) == 0 && strverscmp(uts.release, "2.6.30") < 0)
return;
if (is_selinux_enabled() <= 0)
return;
fp = fopen("/proc/mounts", "r");
if (!fp)
return;
while ((num = getline(&buf, &len, fp)) != -1) {
found = 0;
index = 0;
item = strtok(buf, " ");
while (item != NULL) {
mount_info[index] = item;
if (index == 3)
break;
index++;
item = strtok(NULL, " ");
}
if (index < 3) {
fprintf(stderr,
"/proc/mounts record \"%s\" has incorrect format.\n",
buf);
continue;
}
/* remove pre-existing entry */
remove_exclude(mount_info[1]);
item = strtok(mount_info[3], ",");
while (item != NULL) {
if (strcmp(item, "seclabel") == 0) {
found = 1;
break;
}
item = strtok(NULL, ",");
}
/* exclude mount points without the seclabel option */
if (!found)
add_exclude(mount_info[1]);
}
free(buf);
}

1
policycoreutils/setfiles/restore.h
View File

@ -49,5 +49,6 @@ int exclude(const char *path);
void remove_exclude(const char *directory); void remove_exclude(const char *directory);
int process_one_realpath(char *name, int recurse); int process_one_realpath(char *name, int recurse);
int process_glob(char *name, int recurse); int process_glob(char *name, int recurse);
void exclude_non_seclabel_mounts();
#endif #endif

64
policycoreutils/setfiles/setfiles.c
View File

@ -5,7 +5,6 @@
#include <ctype.h> #include <ctype.h>
#include <regex.h> #include <regex.h>
#include <sys/vfs.h> #include <sys/vfs.h>
#include <sys/utsname.h>
#define __USE_XOPEN_EXTENDED 1 /* nftw */ #define __USE_XOPEN_EXTENDED 1 /* nftw */
#include <libgen.h> #include <libgen.h>
#ifdef USE_AUDIT #ifdef USE_AUDIT
@ -137,69 +136,6 @@ static void maybe_audit_mass_relabel(void)
#endif #endif
} }
/*
Search /proc/mounts for all file systems that do not support extended
attributes and add them to the exclude directory table. File systems
that support security labels have the seclabel option.
*/
static void exclude_non_seclabel_mounts()
{
struct utsname uts;
FILE *fp;
size_t len;
ssize_t num;
int index = 0, found = 0;
char *mount_info[4];
char *buf = NULL, *item;
/* Check to see if the kernel supports seclabel */
if (uname(&uts) == 0 && strverscmp(uts.release, "2.6.30") < 0)
return;
if (is_selinux_enabled() <= 0)
return;
fp = fopen("/proc/mounts", "r");
if (!fp)
return;
while ((num = getline(&buf, &len, fp)) != -1) {
found = 0;
index = 0;
item = strtok(buf, " ");
while (item != NULL) {
mount_info[index] = item;
if (index == 3)
break;
index++;
item = strtok(NULL, " ");
}
if (index < 3) {
fprintf(stderr,
"/proc/mounts record \"%s\" has incorrect format.\n",
buf);
continue;
}
/* remove pre-existing entry */
remove_exclude(mount_info[1]);
item = strtok(mount_info[3], ",");
while (item != NULL) {
if (strcmp(item, "seclabel") == 0) {
found = 1;
break;
}
item = strtok(NULL, ",");
}
/* exclude mount points without the seclabel option */
if (!found)
add_exclude(mount_info[1]);
}
free(buf);
}
int main(int argc, char **argv) int main(int argc, char **argv)
{ {
struct stat sb; struct stat sb;