Commit Graph

15 Commits

Author SHA1 Message Date
Daniel P. Berrange
5f8ce37021 libselinux: Fix const-ness of parameters & make usage() methods static
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:12 -04:00
Daniel P. Berrange
91d9fe8af0 libselinux: Add printf format attribute annotation to die() method
Annotating the die method as taking printf format exposes
a bug in error reporting

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:12 -04:00
Eric Paris
85cfd2fe2e libselinux: use -W and -Werror in utils
Add the flags and fix the one build break.

Signed-off-by: Eric Paris <eparis@redhat.com>
2011-12-05 16:14:17 -05:00
Eric Paris
bedd2a8dc4 libselinux: utils: matchpathcon: remove duplicate declaration
We declare rc both for a function and inside a stanze.  We only need it in the
stanze so remove the declaration for the whole function.

Signed-off-by: Eric Paris <eparis@redhat.com>
2011-09-16 11:54:03 -04:00
Richard Haines
bc1a8e2a4a libselinux: selinux_file_context_verify function returns wrong value.
selinux_file_context_verify(3) should now return the correct codes and
matchpathcon(8) has been modified to handle them.

The selinux_file_context_verify(3)and selinux_file_context_cmp(3) man pages
have also been updated (re-written really) to correct return codes.

I found that selabel_open left errno set to ENOENT because a
file_contexts.subs file did not exist on my system, but left selabel_open
alone and set errno = 0 before calling selinux_filecontext_cmp.

[fix uninitialize init variable in matchpathcon.c::main - eparis]
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-26 14:27:51 -04:00
Eric Paris
7df397d3d9 libselinux: move realpath helper to matchpathcon library
Instead of only doing path simplification and symlink following for the
matchpathcon helper instead do it in the library potion.  This was an
issue when in python some called selinux.matchpatchcon("//lib64", 0) and
got the wrong answer (because the // wasn't being dealt with)

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-26 14:27:37 -04:00
Eric Paris
4ad1896954 libselinux: resolv symlinks and dot directories before matching paths
matchpathcon cannot handle ./ or ../ in pathnames and doesn't do well
with symlinks.  This patch uses the glibc function realpath() to try to
determine a real path with resolved symlinks and dot directories.  For
example before this pach we would see:

$ matchpathcon /tmp/../eric
/tmp/../eric	<<none>>
$ matchpathcon /eric
/eric	system_u:object_r:default_t:s0

Whereas after the path we get the same results.  The one quirk with the
patch is that we need special code to make sure that realpath() does not
follow a symlink if it is the final component.  aka if we have a symlink
from /eric to /tmp/eric we do not want to resolv to /tmp/eric.  We want
to just resolv to the actual symlink /eric.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-11 23:35:48 -04:00
Eric Paris
84ea17b5f3 libselinux: move .gitignore into utils
There is a .gitignore at the head of the directory but only contains
entries for the utils directory.  Move to the utils directory.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-02 13:33:52 -04:00
Eric Paris
5ef65fd784 libselinux: new setexecon utility
This utility will tell what context a new task will have after exec
based on the pathname and the context of the launching task.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-02 13:33:35 -04:00
Daniel J Walsh
00f0d550d5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: refpolicy: nsalibselinux_utils_matchpathcon.c changes
Date: Tue, 07 Jul 2009 12:30:52 -0400

--text follows this line--

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-09-28 16:17:23 -04:00
Daniel J Walsh
20eff2b9a5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Patch to getdefaultcon to print just the correct match and add verbose option
Date: Wed, 04 Mar 2009 15:41:37 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I really want to rename this to selinuxdefaultcon, which is what we ship
in Fedora.

Also exit with proper error on failure.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu54AACgkQrlYvE4MpobNoZACdHgQDP2Hp/KDBpGCD7G08HjOX
p68An25Uu83SlOqjKyy9EG8ZgdIcuTCB
=L6UU
-----END PGP SIGNATURE-----

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-05-14 15:43:18 -04:00
Chad Sellers
72d535fdb8 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: We have moved matchpathcon to /sbin from /usr/sbin
Date: Wed, 01 Apr 2009 10:21:53 -0400

Some init scripts wanted to use matchpathcon before /usr is mounted.

Author: Chad Sellers
Email: csellers@tresys.com

Added matchpathcon to clean target

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-05-07 16:05:05 -04:00
Daniel J Walsh
93a680280f Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Patch matchpathcon to eliminate file "/"
Date: Wed, 04 Mar 2009 15:39:31 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So

matchpathcon /etc/
Will work the same as
matchpathcon /etc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu5wMACgkQrlYvE4MpobNK4gCgiVeXXEZcCMsJKXM7jqh6r1u3
OScAoLcmXBIR63gpvA8RS3g07pcPC6IF
=e+Re
-----END PGP SIGNATURE-----

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-04-10 11:33:23 -04:00
Joshua Brindle
86562db50a Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: matchpathcon -V does not always work as expected.
Date: Tue, 30 Sep 2008 08:54:18 -0400

matchpathcon -V should be passing the mode when checking whether the
file context on a file is correct.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2008-10-14 07:33:19 -04:00
Joshua Brindle
13cd4c8960 initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00