RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

policycoreutils: setfiles: do not restrict checks against a binary policy 

The -c option allows to check the validity of contexts against a
specified binary policy. Its use is restricted: no pathname can be used
when a binary policy is given to setfiles. It's not clear if this is
intentional as the built-in help and the man page are not stating the
same thing about this (the man page document -c as a normal option,
while the built-in help shows it is restricted).

When generating full system images later used with SELinux in enforcing
mode, the extended attributed of files have to be set by the build
machine. The issue is setfiles always checks the contexts against a
policy (ctx_validate = 1) and using an external binary policy is not
currently possible when using a pathname. This ends up in setfiles
failing early as the contexts of the target image are not always
compatible with the ones of the build machine.

This patch reworks a check on optind only made when -c is used, that
enforced the use of a single argument to allow 1+ arguments, allowing to
use setfiles with an external binary policy and pathnames. The following
command is then allowed, as already documented in the man page:

  $ setfiles -m -r target/ -c policy.32 file_contexts target/

Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
This commit is contained in:
Antoine Tenart 2020-07-07 16:35:01 +02:00 committed by Petr Lautrbach
parent 5f844b6991
commit c94e542c98
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
policycoreutils/setfiles/setfiles.c
View File

@ -48,11 +48,10 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
name, name); name, name);
} else { } else {
fprintf(stderr, fprintf(stderr,
"usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n" "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
"usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n" "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
"usage: %s -s [-diIDlmnpqvFW] spec_file\n" "usage: %s -s [-diIDlmnpqvFW] spec_file\n",
"usage: %s -c policyfile spec_file\n", name, name, name);
name, name, name, name);
} }
exit(-1); exit(-1);
} }
@ -409,7 +408,7 @@ int main(int argc, char **argv)
if (!iamrestorecon) { if (!iamrestorecon) {
if (policyfile) { if (policyfile) {
if (optind != (argc - 1)) if (optind > (argc - 1))
usage(argv[0]); usage(argv[0]);
} else if (use_input_file) { } else if (use_input_file) {
if (optind != (argc - 1)) { if (optind != (argc - 1)) {