RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-25 15:32:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

libselinux: verify file_contexts when using restorecon

Browse Source 
In permissive mode, calling restorecon with a bad label in file_contexts
does not verify the label's existence in the loaded policy. This
results in any label successfully applying to a file, as long as the
file exists.

This issue has two assumptions:

1) file_contexts must be manually updated with the invalid label.
Running `semanage fcontext` will error when attempting to add
an invalid label to file_contexts.
2) the system must be in permissive. Although applying an invalid label
in enforcing gives an error and fails, successfully labeling a file with a
bad label could cause issues during policy development in permissive.

Instead, as each context is used, verify it is valid before blindly
applying the label. If an error with validation occurs in restorecon,
application of remaining valid labels will be uninterrupted as before.

Signed-off-by: Yuli Khodorkovskiy <ykhodo@gmail.com>
This commit is contained in:
Yuli Khodorkovskiy 2018-03-29 17:16:41 -07:00 committed by William Roberts
parent 4ba19b541d
commit 814631d3ae
6 changed files with 10 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libselinux/src/label.c
View File

@ -121,12 +121,11 @@ static inline int selabel_is_validate_set(const struct selinux_opt *opts,
return 0;
}
int selabel_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts)
int selabel_validate(struct selabel_lookup_rec *contexts)
{
int rc = 0;
if (!rec->validating || contexts->validated)
if (contexts->validated)
goto out;
rc = selinux_validate(&contexts->ctx_raw);
@ -143,7 +142,7 @@ static int selabel_fini(struct selabel_handle *rec,
struct selabel_lookup_rec *lr,
int translating)
{
if (compat_validate(rec, lr, rec->spec_file, 0))
if (compat_validate(lr, rec->spec_file, 0))
return -1;
if (translating && !lr->ctx_trans &&

2
libselinux/src/label_backends_android.c
View File

@ -122,7 +122,7 @@ static int process_line(struct selabel_handle *rec,
spec_arr[nspec].lr.ctx_raw = context;
if (rec->validating) {
if (selabel_validate(rec, &spec_arr[nspec].lr) < 0) {
if (selabel_validate(&spec_arr[nspec].lr) < 0) {
selinux_log(SELINUX_ERROR,
"%s: line %u has invalid context %s\n",
path, lineno, spec_arr[nspec].lr.ctx_raw);

2
libselinux/src/label_file.c
View File

@ -328,7 +328,7 @@ end_arch_check:
spec->lr.ctx_raw = str_buf;
if (strcmp(spec->lr.ctx_raw, "<<none>>") && rec->validating) {
if (selabel_validate(rec, &spec->lr) < 0) {
if (selabel_validate(&spec->lr) < 0) {
selinux_log(SELINUX_ERROR,
"%s: context %s is invalid\n",
path, spec->lr.ctx_raw);

2
libselinux/src/label_file.h
View File

@ -506,7 +506,7 @@ static inline int process_line(struct selabel_handle *rec,
spec_hasMetaChars(&spec_arr[nspec]);
if (strcmp(context, "<<none>>") && rec->validating)
return compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
return compat_validate(&spec_arr[nspec].lr, path, lineno);
return 0;
}

6
libselinux/src/label_internal.h
View File

@ -111,8 +111,7 @@ struct selabel_handle {
* Validation function
*/
extern int
selabel_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts) hidden;
selabel_validate(struct selabel_lookup_rec *contexts) hidden;
/*
* Compatibility support
@ -127,8 +126,7 @@ extern void __attribute__ ((format(printf, 1, 2)))
selinux_log(type, fmt);
extern int
compat_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts,
compat_validate(struct selabel_lookup_rec *contexts,
const char *path, unsigned lineno) hidden;
/*

5
libselinux/src/matchpathcon.c
View File

@ -35,8 +35,7 @@ void set_matchpathcon_printf(void (*f) (const char *fmt, ...))
myprintf_compat = 1;
}
int compat_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts,
int compat_validate(struct selabel_lookup_rec *contexts,
const char *path, unsigned lineno)
{
int rc;
@ -47,7 +46,7 @@ int compat_validate(struct selabel_handle *rec,
else if (mycanoncon)
rc = mycanoncon(path, lineno, ctx);
else {
rc = selabel_validate(rec, contexts);
rc = selabel_validate(contexts);
if (rc < 0) {
if (lineno) {
COMPAT_LOG(SELINUX_WARNING,