Commit Graph

74 Commits

Author SHA1 Message Date
Eric Paris
dac8b32c17 libselinux: utils: new file context regex compiler
This is a new 'compiler' which tranforms the file context database into
a binary format.  This binary format may be mmap'd in later removing the
need to compile the regular expression at run time.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:56 -05:00
Dan Walsh
fa7a9a604e libselinux: utils: avcstat: clear sa_mask set
We were leaving random stack garbage in sa.sa_mask.  Clear it the way
one should.  (spotted by coveriety)

Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 14:30:21 -04:00
Eric Paris
1db01640ee libselinux: matchpathcon: add -m option to force file type check
We may want to force matchpathcon to respond if the path is question is
a dir, sockfile, chr, blk, etc.  Add an option so you can force it to
hit the right rule types.

Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 14:23:22 -04:00
Dan Walsh
bac96c8c70 libselinux: getsebool: support boolean name substitution
Use selinux_boolean_sub to translate the boolean name handed in by the user.
Report back the correct name of the boolean.

Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 13:14:29 -04:00
Eric Paris
056f23c4bf libselinux: utils: add service to getdefaultcon
Add a -s option to getdefaultcon which allows one to specify the
service in question.  This exposes all of the abilities of getseuser
instead of only the abilities of getseuserbyname.

Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 12:16:18 -04:00
Dan Walsh
ac6ab3afc0 libselinux: Fortify source now requires all code to be compiled with -O flag
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-06-28 11:21:16 -04:00
Dan Walsh
9b796ead1a libselinux: utils: Stop separating out matchpathcon as something special
It's not special and doesn't need its own Makefile lines.  Just make it
a normal target.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Dan Walsh
46d294f645 libselinux: Update Makefiles to handle /usrmove
Move everything into /usr/* and just put links from /*.  The whole /usr
thing hasn't really worked in all situations for a long long time.  Just
accept that fact and move along.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Daniel P. Berrange
a1044d4c84 libselinux: utils: Enable many more gcc warnings for libselinux/utils builds
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Daniel P. Berrange
5f8ce37021 libselinux: Fix const-ness of parameters & make usage() methods static
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:12 -04:00
Daniel P. Berrange
91d9fe8af0 libselinux: Add printf format attribute annotation to die() method
Annotating the die method as taking printf format exposes
a bug in error reporting

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:12 -04:00
Eric Paris
85cfd2fe2e libselinux: use -W and -Werror in utils
Add the flags and fix the one build break.

Signed-off-by: Eric Paris <eparis@redhat.com>
2011-12-05 16:14:17 -05:00
Eric Paris
bedd2a8dc4 libselinux: utils: matchpathcon: remove duplicate declaration
We declare rc both for a function and inside a stanze.  We only need it in the
stanze so remove the declaration for the whole function.

Signed-off-by: Eric Paris <eparis@redhat.com>
2011-09-16 11:54:03 -04:00
Richard Haines
bc1a8e2a4a libselinux: selinux_file_context_verify function returns wrong value.
selinux_file_context_verify(3) should now return the correct codes and
matchpathcon(8) has been modified to handle them.

The selinux_file_context_verify(3)and selinux_file_context_cmp(3) man pages
have also been updated (re-written really) to correct return codes.

I found that selabel_open left errno set to ENOENT because a
file_contexts.subs file did not exist on my system, but left selabel_open
alone and set errno = 0 before calling selinux_filecontext_cmp.

[fix uninitialize init variable in matchpathcon.c::main - eparis]
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-26 14:27:51 -04:00
Eric Paris
7df397d3d9 libselinux: move realpath helper to matchpathcon library
Instead of only doing path simplification and symlink following for the
matchpathcon helper instead do it in the library potion.  This was an
issue when in python some called selinux.matchpatchcon("//lib64", 0) and
got the wrong answer (because the // wasn't being dealt with)

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-26 14:27:37 -04:00
Eric Paris
4ad1896954 libselinux: resolv symlinks and dot directories before matching paths
matchpathcon cannot handle ./ or ../ in pathnames and doesn't do well
with symlinks.  This patch uses the glibc function realpath() to try to
determine a real path with resolved symlinks and dot directories.  For
example before this pach we would see:

$ matchpathcon /tmp/../eric
/tmp/../eric	<<none>>
$ matchpathcon /eric
/eric	system_u:object_r:default_t:s0

Whereas after the path we get the same results.  The one quirk with the
patch is that we need special code to make sure that realpath() does not
follow a symlink if it is the final component.  aka if we have a symlink
from /eric to /tmp/eric we do not want to resolv to /tmp/eric.  We want
to just resolv to the actual symlink /eric.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-11 23:35:48 -04:00
Eric Paris
84ea17b5f3 libselinux: move .gitignore into utils
There is a .gitignore at the head of the directory but only contains
entries for the utils directory.  Move to the utils directory.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-02 13:33:52 -04:00
Eric Paris
5ef65fd784 libselinux: new setexecon utility
This utility will tell what context a new task will have after exec
based on the pathname and the context of the launching task.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-02 13:33:35 -04:00
Daniel J Walsh
00f0d550d5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: refpolicy: nsalibselinux_utils_matchpathcon.c changes
Date: Tue, 07 Jul 2009 12:30:52 -0400

--text follows this line--

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-09-28 16:17:23 -04:00
Daniel J Walsh
20eff2b9a5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Patch to getdefaultcon to print just the correct match and add verbose option
Date: Wed, 04 Mar 2009 15:41:37 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I really want to rename this to selinuxdefaultcon, which is what we ship
in Fedora.

Also exit with proper error on failure.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu54AACgkQrlYvE4MpobNoZACdHgQDP2Hp/KDBpGCD7G08HjOX
p68An25Uu83SlOqjKyy9EG8ZgdIcuTCB
=L6UU
-----END PGP SIGNATURE-----

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-05-14 15:43:18 -04:00
Chad Sellers
72d535fdb8 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: We have moved matchpathcon to /sbin from /usr/sbin
Date: Wed, 01 Apr 2009 10:21:53 -0400

Some init scripts wanted to use matchpathcon before /usr is mounted.

Author: Chad Sellers
Email: csellers@tresys.com

Added matchpathcon to clean target

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-05-07 16:05:05 -04:00
Daniel J Walsh
93a680280f Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Patch matchpathcon to eliminate file "/"
Date: Wed, 04 Mar 2009 15:39:31 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So

matchpathcon /etc/
Will work the same as
matchpathcon /etc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu5wMACgkQrlYvE4MpobNK4gCgiVeXXEZcCMsJKXM7jqh6r1u3
OScAoLcmXBIR63gpvA8RS3g07pcPC6IF
=e+Re
-----END PGP SIGNATURE-----

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-04-10 11:33:23 -04:00
Joshua Brindle
86562db50a Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: matchpathcon -V does not always work as expected.
Date: Tue, 30 Sep 2008 08:54:18 -0400

matchpathcon -V should be passing the mode when checking whether the
file context on a file is correct.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2008-10-14 07:33:19 -04:00
Joshua Brindle
13cd4c8960 initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00