Commit Graph

389 Commits

Author SHA1 Message Date
Stephen Smalley
0079008a54 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-07-10 12:31:08 -04:00
Richard Haines
f2cd2f821f libselinux: Add const to selinux_opt for label backends.
Change selabel_open and label backends to take a
'const struct selinux_opt' argument. This work has already
been done for the Android version components.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-07-10 12:30:09 -04:00
Stephen Smalley
0979e35ddb Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-07-06 11:10:17 -04:00
Richard Haines
f309a0e88c libselinux: Fix binary file labels for regexes with metachars
File labels assigned using the lookup_best_match() function do not
assign the best match if its regex contains metacharacters in the
binary file_contexts file version.

This change adds a new entry in the binary file with the calculated
prefix length that is then read when processing the file. This fix
also bumps SELINUX_COMPILED_FCONTEXT_MAX_VERS.

This patch relies on patch [1] that fixes the same problem
for text based file_contexts files.

[1] http://marc.info/?l=selinux&m=143576498713964&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-07-06 11:09:12 -04:00
Stephen Smalley
36938c293e Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-07-06 10:59:01 -04:00
Jeff Vander Stoep
35a7c3e536 libselinux: Fix file labels for regexes with metachars
File labels assigned using the lookup_best_match() function do not
assign the best match if its regex contains metacharacters.

For non-exact regex matches, lookup_best_match() finds the closest match
by tracking the length of the matching prefix. Prefix match is tracked via
the prefix_len variable. This was previously calculated and set in
the spec_hasMetaChars() function. Commit 3cb6078 removed the
prefix_len calculation, this commit restores it.

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
2015-07-06 10:58:09 -04:00
Stephen Smalley
539b408cc2 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-26 12:58:16 -04:00
Richard Haines
893c2924e0 libselinux: Fix if file_contexts not '\n' terminated
If the last line of a file_contexts file is not '\n' terminated
or if any line has additional isspace(3) characters at end, it
gave an invalid file type error.
read_spec_entries now handles these situations.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-26 12:36:16 -04:00
Stephen Smalley
aab9d90b35 libselinux: Correctly handle an empty file_contexts file.
If you add some local file contexts via semanage fcontext -a and
later delete them all via semanage fcontext -D, you get an empty
file_contexts.local file.  Then when you try to load it, getline()
returns 0 and we fall through to the out path without having set rc.
In label_file.c, rc will always be non-zero at this point because
we will have failed the load_mmap() call.  In sefcontext_compile,
rc may contain random garbage at this point.  Explicitly set rc
before the loop.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-22 09:11:33 -04:00
Stephen Smalley
ac78c677ab Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-16 12:30:35 -04:00
Richard Haines
3cb6078ae5 libselinux: Enhance file context support
Update file contexts generation and loading to use common code.

Remove "status = 0; after "status = sort_specs(data);" otherwise
the function will never indicate a failure.

The file labeling code also has minor formatting, white space
removal etc. changes.

label_file.c - Move process_line function to label_file.h
sefcontext_compile.c - Update to use common process_line code. Now frees
all malloc'ed memory, checked by valgrind. Also added optional -o output
file parameter - updated man page to reflect this change.

V2 - Revert to using compat_validate instead of selabel_validate.
V3 - Revert to using callback for validation now the problem has been
fixed by commit e889148494
("libselinux:  build sefcontext_compile with static libselinux")

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-16 12:30:08 -04:00
Stephen Smalley
e889148494 libselinux: build sefcontext_compile with static libselinux
sefcontext_compile depends on libselinux internals, so it might
as well use static libselinux.  Hide read_spec_entries as this is not
intended as a public interface for shared library users.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-15 15:25:42 -04:00
Stephen Smalley
4ed298c652 Updated libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-15 11:54:27 -04:00
Richard Haines
9eae65894a libselinux: Fix property processing and cleanup formatting
Fix memory issues flagged by valgrind.
These changes bring the property service in line with Android [1]

V2 reverts to original upstream %u when logging errors. Android needs
these corrections also.

[1] https://android-review.googlesource.com/#/c/153580/

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-15 11:53:38 -04:00
Stephen Smalley
59e02f65ca libselinux: Drop confusing comment.
When Eamon created label_file.c, he drew code from the setfiles program,
which I originally wrote.  At the time, setfiles had a comment
about being derived in part from the setfiles.pl script written by SCC, so
Eamon put a comment in label_file.c that tried to preserve that lineage.
However, there was no real code lineage there.  The setfiles program
was inspired by the setfiles.pl perl script, but the implementation was
a complete rewrite.  And while label_file.c drew some data structures and
code from the setfiles C program, it had nothing to do with the setfiles.pl
script at all.  Just drop the comment; it serves no purpose.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-08 12:49:49 -04:00
Stephen Smalley
e2eaec298f Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-03 10:49:35 -04:00
Richard Haines
af41e2b5ff libselinux: Add read_spec_entries function to replace sscanf
Currently sscanf is used with %ms parameters that are not supported
on all platforms. The new read_spec_entries function may be used
to replace these where required. This patch updates
sefcontext_compile, label_file and label_android_property services
to use the new function.

The file and property services have been tested on Android emulator
and the file service on Fedora 21.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-03 10:43:33 -04:00
Stephen Smalley
ae662a0654 Updated libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-27 12:30:22 -04:00
Richard Haines
f233d01015 libselinux: Support consistent mode size for bin files
Currently sefcontext_compile defines the mode field as mode_t whose
size will vary depending on the architecture (e.g. 32 bit / 64 bit).
This patch sets the size when writing/reading binary files to
uint32_t. The file version is set to SELINUX_COMPILED_FCONTEXT_MODE

V2 fixes those listed in http://marc.info/?l=selinux&m=143273965514292&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-27 12:22:32 -04:00
Stephen Smalley
e595ed2023 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-27 11:50:59 -04:00
Stephen Smalley
ab73411556 libselinux: Expunge remaining references to flask.h and av_permissions.h.
Missed a few references to these header files when they were
deprecated in 76913d8adb.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-27 11:44:40 -04:00
Stephen Smalley
674256be88 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-26 11:41:44 -04:00
Richard Haines
f7148d5973 Fix more bin file processing core dumps
The reading of bin files has been changed to follow that of loading
policy to catch over-runs. Entries that should be NUL terminated are
also checked. If any error, then process the text file. This should
fix all problems highlighted in [1] with V2 fixing those in [2].
V3 corrects int32_t/uint32_t for *_len entries and V4 fixes [3]
and adds pcre_fullinfo checks to validate regex and study data
sizes. pcre_fullinfo also validates its magic number.

Tested with bin files built using sefcontext_compile PCRE_VERS 1 and 2.

The following is a rough guide to the difference in processing a bin
file against a text file:
   6K entries - x5
   4K entries - x4
   1K entries - x3
   500 entries - x2

[1] http://marc.info/?l=selinux&m=143101983922281&w=2
[2] http://marc.info/?l=selinux&m=143161763905159&w=2
[3] http://marc.info/?l=selinux&m=143204170705586&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-26 11:32:23 -04:00
Stephen Smalley
49a17da15c Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-21 13:12:23 -04:00
Petr Lautrbach
8d7c2854c5 libselinux: add selinux_openssh_contexts_path()
openssh in Fedora uses "sshd_net_t" type for privilege separated
processes in the preauthentication phase. Similarly, openssh portable uses
"sftp_t" for internal-sftp processes. Both type are hardcoded what is not ideal.
Therefore selinux_openssh_contexts_path() was created to get a path where sshd
can get a correct types prepared by a distribution or an administrator.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2015-05-21 13:11:36 -04:00
Stephen Smalley
af8e863c12 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-20 16:37:03 -04:00
Stephen Smalley
a03f006d7e libselinux: setrans_client: minimize overhead when mcstransd is not present.
As mcstransd is not installed/running by default, we should not impose
the overhead of trying to connect to it on each operation that takes or
returns a security context string.  Test for the existence of the socket
file on first use, and if the socket file does not exist, then skip the
processing on all subsequent calls.

Previously we had a similar attempt at optimization by checking
whether MLS was enabled, but since the kernel MLS support is enabled
even for -mcs and mcstransd is no longer installed/running by default,
this is not a useful optimization.  Just replace it with the new test.

Compare strace ls -Z /usr/bin |& grep .setrans-unix before and after
this patch to get a sense of the impact.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-20 16:19:20 -04:00
Stephen Smalley
8dcfaddec8 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-18 11:54:07 -04:00
Richard Haines
fc12f93a13 libselinux: Ensure selabel_lookup_best_match links NULL terminated
Ensure that the array of strings is NULL terminated to stop core
dumps. Also cleaned up code.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-18 11:53:25 -04:00
Stephen Smalley
85bb06b31c Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-11 10:30:10 -04:00
Stephen Smalley
c08c4eacab libselinux: is_selinux_enabled: Add /etc/selinux/config test.
To avoid regressions such as the one reported in:
https://bugzilla.redhat.com/show_bug.cgi?id=1219045
add a test for /etc/selinux/config to is_selinux_enabled().

This ensures that systems that do not install selinux-policy
will continue to return 0 from is_selinux_enabled().

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-11 10:30:01 -04:00
Stephen Smalley
26e05da0fc libselinux: matchpathcon/selabel_file: Fix man pages.
As discussed in https://bugzilla.redhat.com/show_bug.cgi?id=1219718,
there are several inconsistencies between the matchpathcon man page
and the implementation.  The same is true of the SELABEL_OPT_SUBSET
option for the selabel_file backend.  Fix the man pages for both.
Also note in the man pages that the entire matchpathcon family
of functions is deprecated and recommend use of the corresponding
selabel interfaces for new code.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-11 09:53:37 -04:00
Stephen Smalley
fe0366b8ed Update libselinux ChangeLog. 2015-05-07 12:47:21 -04:00
Richard Haines
a351eb01a8 libselinux: Fix core dumps with corrupt *.bin files
Check buffer address limits when processing *.bin files
to catch any over-runs. On failure process text file instead.

To test, the bin files were corrupted by adding and removing
various bits of data. Various file sizes were also checked and
all were caught by the patch.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-07 12:00:07 -04:00
Stephen Smalley
4d0d9c7004 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-06 11:59:18 -04:00
Richard Haines
e7f970ffd1 libselinux: Add selabel partial and best match APIs
Add support for new API functions selabel_partial_match and
selabel_lookup_best_match ported from the Android libselinux
fork.

Add supporting man(3) pages and test utilities: selabel_lookup,
selabel_lookup_best_match and selabel_partial_match.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-06 11:58:44 -04:00
Steve Lawrence
de4f82bb7f Move ChangeLog entry to the correct project 2015-04-21 08:49:32 -04:00
Miro Hrončok
42ac8d6dc4 libselinux: selinux.py - use os.walk() instead of os.path.walk()
os.path.walk() function is deprecated and has been removed in Python 3

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Acked-by: Steve Lawrence <slawrence@tresys.com>
2015-04-21 08:15:02 -04:00
Stephen Smalley
27d5377cc7 Updated libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-17 12:38:10 -04:00
Stephen Smalley
685f4aeead libselinux: is_selinux_enabled(): drop no-policy-loaded test.
SELinux can be disabled via the selinux=0 kernel parameter or via
/sys/fs/selinux/disable (triggered by setting SELINUX=disabled in
/etc/selinux/config).  In either case, selinuxfs will be unmounted
and unregistered and therefore it is sufficient to check for the
selinuxfs mount.  We do not need to check for no-policy-loaded and
treat that as SELinux-disabled anymore; that is a relic of Fedora Core 2
days.  Drop the no-policy-loaded test, which was a bit of a hack anyway
(checking whether getcon_raw() returned "kernel" as that can only happen
if no policy is yet loaded and therefore security_sid_to_context() only
has the initial SID name available to return as the context).

May possibly fix https://bugzilla.redhat.com/show_bug.cgi?id=1195074
by virtue of removing the call to getcon_raw() and therefore avoiding
use of tls on is_selinux_enabled() calls.  Regardless, it will make
is_selinux_enabled() faster and simpler.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-17 09:38:18 -04:00
Stephen Smalley
974f565415 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-16 09:51:31 -04:00
Stephen Smalley
082f1d1274 libselinux: Remove deprecated mudflap option.
The mudflap run time checker was removed in GCC 4.9.  The
option no longer does anything and triggers a warning from gcc 4.9
and later.  Remove it.  We might want to add -fsanitize=address
to enable AddressSanitizer in its place, but that should be a separate
change.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-16 08:23:55 -04:00
Stephen Smalley
c4bd396492 Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-04-16 07:50:25 -04:00
Ben Shelton
9df4988846 libselinux: Mount procfs before checking /proc/filesystems
In the case where the SELinux security module is not loaded in the
kernel and it's early enough in the boot process that /proc has not yet
been mounted, selinuxfs_exists() will incorrectly return 1, and
selinux_init_load_policy() will print a message like this to the
console:

Mount failed for selinuxfs on /sys/fs/selinux:  No such file or directory

To fix this, mount the procfs before attempting to open
/proc/filesystems, and unmount it when done if it was initially not
mounted.  This is the same thing that selinux_init_load_policy() does
when reading /proc/cmdline.

Signed-off-by: Ben Shelton <ben.shelton@ni.com>
2015-04-16 07:49:14 -04:00
Stephen Smalley
50788b155d Update libselinux and policycoreutils ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 14:18:34 -04:00
Petr Lautrbach
417cb8d076 Fix -Wformat errors
Fixes two types of errors which appear when building with gcc-5.0.0

- format ‘%d’ expects argument of type ‘int’, but argument X has type ‘unsigned int’
- format ‘%a’ expects argument of type ‘float *’, but argument X has type ‘char **’

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2015-03-13 14:14:23 -04:00
Stephen Smalley
ae44b7bb39 libselinux: sefcontext_compile: handle newlines in file names
restorecon on file names with newlines are not handled properly.
Use PCRE_DOTALL so that dots in regular expressions match all
characters, and don't exclude the newline character.

See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
for background.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-02-24 12:20:42 -05:00
Stephen Smalley
07ed7784cf Update libselinux ChangeLog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-02-24 10:50:56 -05:00
Nick Kralevich
716e3820c5 libselinux: label_file: handle newlines in file names
restorecon on file names with newlines are not handled properly.
Use PCRE_DOTALL so that dots in regular expressions match all
characters, and don't exclude the newline character.

See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
for background.

Change-Id: I0dde8f2567305f746d19ebd75a9e2add7406eb9a
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-02-24 10:42:09 -05:00
Stephen Smalley
b2beb5304d Update libselinux Changelog.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-02-23 11:08:51 -05:00