Commit Graph

89 Commits

Author SHA1 Message Date
Stephen Smalley
e76569f863 libselinux: avcstat: fix build warning
Fix the following build warning.

avcstat.c: In function ‘main’:
avcstat.c:113:4: error: ‘strncpy’ specified bound 4096 equals destination size [-Werror=stringop-truncation]
    strncpy(avcstatfile, optarg, sizeof avcstatfile);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-05-08 08:11:58 -04:00
Nicolas Iooss
efc77aa209 libselinux: remove unused variable usercon
In getconlist.c, main() does not use usercon. Remove this variable.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2018-04-17 13:55:57 -07:00
Nicolas Iooss
5f76f6b8fb libselinux: fix memory leak in getconlist
In getconlist.c's main(), "level" is duplicated from an optional
argument without being ever freed. clang's static analyzer warns about
this memory leak.

Free the allocated memory properly in order to remove a warning reported
by clang's static analyzer.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2018-04-17 13:55:57 -07:00
Marcus Folkesson
b24980ec07 libselinux: build: follow standard semantics for DESTDIR and PREFIX
This patch solves the following issues:
- The pkg-config files generates odd paths when using DESTDIR without PREFIX
- DESTDIR is needed during compile time to compute library and header paths which it should not.
- Installing with both DESTDIR and PREFIX set gives us odd paths
- Make usage of DESTDIR and PREFIX more standard

Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
2018-02-14 15:59:36 +01:00
Patrick Steinhardt
ca07a2ad46 libselinux: avoid redefining _FORTIFY_SOURCE
Two makefiles of ours pass `-D_FORTIFY_SOURCE=2` directly to the
preprocessor. While this does not pose any problems when the value has
not been previously set, it can break the build if it is part of the
standard build flags.

The issue can easily be fixed by instead defining `_FORTIFY_SOURCE`
without specifying a concrete value. In this case, gcc will not error
out and simply keep using the previously defined value. On the other
hand, if no value has been defined, we will now compile with
`_FORTIFY_SOURCE=1`. From feature_test_macros(7):

    If _FORTIFY_SOURCE is set to 1, with compiler optimization level 1
    (gcc -O1) and above, checks that shouldn't change the behavior of
    conforming programs are performed.  With _FORTIFY_SOURCE set to 2,
    some more checking is added, but some conforming programs might
    fail.

While this leaves us with less checks for buffer overflows, it will only
enable checks that should not change behaviour of conforming programs.
With _FORTIFY_SOURCE=2, the compiler may even unintentionally change
behaviour of conforming programs. So in fact, one could even argue that
we should only be setting the value to 1 anyway to avoid surprising side
effects.

So this patch changes our CFLAGS to only pass `-D_FORTIFY_SOURCE`
without any concrete value, fixing the build issue.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
2017-06-22 16:44:07 -04:00
Stephen Smalley
7b5699bfd7 Fix BINDIR/SBINDIR/... variables in Makefiles
As reported by Nicolas Iooss, there are still some inconsistencies
in the definitions and usage of Makefile variables related to bin
and sbin directories. Since we need to still support non-usrmerge
systems, we cannot completely synchronize them, but we can eliminate
unnecessary differences, remove unused variables, and drop the
USRSBINDIR variables.

Before:
$ find . -name Makefile -exec cat {} + |grep '^[A-Z_]*BINDIR' |sort -u
BINDIR=$(PREFIX)/bin
BINDIR ?= $(PREFIX)/bin
BINDIR ?= $(PREFIX)/sbin
SBINDIR ?= $(DESTDIR)/sbin
SBINDIR ?= $(PREFIX)/sbin
USRSBINDIR ?= $(PREFIX)/sbin

After:
$ find . -name Makefile -exec cat {} + | grep '^[A-Z_]*BINDIR' | sort -u
BINDIR ?= $(PREFIX)/bin
SBINDIR ?= $(DESTDIR)/sbin
SBINDIR ?= $(PREFIX)/sbin

This does not change the actual install location of any file.
It does drop the legacy symlink from /usr/sbin/load_policy to
/sbin/load_policy; packagers can create that separately if
desired.

Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-20 12:18:26 -04:00
Jason Zaman
297877ab88 libselinux utils: override LD{FLAGS, LIBS} for libselinux.so in Makefile
the utils dir link to libselinux.so which was just built, if LDFLAGS or
LDLIBS were specificed on the make commandline then the search path is
not appended. Add the override directive to fix this.

Gentoo-Bug: https://bugs.gentoo.org/621762

Signed-off-by: Jason Zaman <jason@perfinion.com>
2017-06-19 11:23:06 -04:00
Bernhard M. Wiedemann
c18ea1df62 sort input files
when building packages (e.g. for openSUSE Linux)
(random) filesystem order of input files
influences ordering of functions in the output,
thus without the patch, builds (in disposable VMs) would usually differ.

See https://reproducible-builds.org/ for why this matters.
2017-06-01 14:00:30 -04:00
Stephen Smalley
63aa7fc036 libselinux: Fix CFLAGS definition
commit 16c123f4b1 ("libselinux:
support ANDROID_HOST=1 on Mac") split up warning flags in
CFLAGS based on compiler support in a manner that could lead to
including a subset that is invalid, e.g. upon
make DESTDIR=/path/to/dest install.  Fix it.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-05-09 10:47:39 -04:00
Nicolas Iooss
232ff757d4 libselinux/utils: add noreturn attribute to selinux_check_access's usage
When building libselinux, clang reports the following warning:

    selinux_check_access.c:8:1: error: function 'usage' could be
    declared with attribute 'noreturn' [-Werror,-Wmissing-noreturn]

While at it, make progname const.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2017-05-05 13:07:04 -04:00
Richard Haines
ef95c6ddf9 libselinux: Remove util/selinux_restorecon.c
Remove util/selinux_restorecon.c and tidy up. This is removed as
the functionality is now in policycoreutils/setfiles.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2017-05-02 11:03:06 -04:00
Richard Haines
a63858b52f libselinux: Add selinux_check_access utility
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2017-05-02 10:58:22 -04:00
Jason Zaman
fcb5d5cc72 Makefiles: drop -L/-I to system paths
The toolchain automatically handles them and they break cross compiling.

LDFLAGS should also come before object files, some flags (eg,
-Wl,as-needed) can break things if they are in the wrong place)

Gentoo-Bug: https://bugs.gentoo.org/500674

Signed-off-by: Jason Zaman <jason@perfinion.com>
2017-04-25 08:27:05 -04:00
Jason Zaman
b5fe48da20 libselinux: PCRE_LDFLAGS is actually LDLIBS
>From Make's manual:

LDFLAGS
Extra flags to give to compilers when they are supposed to invoke the
linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the
LDLIBS variable instead.

LDLIBS
Library flags or names given to compilers when they are supposed to
invoke the linker, ‘ld’. Non-library linker flags, such as -L, should go
in the LDFLAGS variable.

https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html

Signed-off-by: Jason Zaman <jason@perfinion.com>
2017-04-25 08:23:45 -04:00
Nicolas Iooss
bb3f428c08 libselinux: getsebool: always free names
When getsebool's main() fails to allocate memory for the boolean names,
it returns without freeing variables first, even though other errors do
this (with label "out").

This silences a warning reported by clang's static analyzer.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2017-04-12 14:46:02 -04:00
Nicolas Iooss
3c85f9f1a0 libselinux: include errno.h instead of sys/errno.h
Building with musl libc leads to some build errors:

    setrans_client.c: In function ‘receive_response’:
    setrans_client.c:147:19: error: implicit declaration of function
    ‘readv’ [-Werror=implicit-function-declaration]
      while (((count = readv(fd, resp_hdr, 3)) < 0) && (errno == EINTR)) ;
                       ^~~~~

and:

    In file included from matchpathcon.c:10:0:
    /usr/include/sys/errno.h:1:2: error: #warning redirecting incorrect
    #include <sys/errno.h> to <errno.h> [-Werror=cpp]
     #warning redirecting incorrect #include <sys/errno.h> to <errno.h>
      ^

Fix the first one by including <sys/uio.h> and the second one by using
<errno.h> instead of <sys/errno.h>.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2017-01-09 16:00:22 -05:00
Nicolas Iooss
055d14a99a libselinux/utils: do not create an empty /sbin directory
When building libselinux package, "make install" creates /sbin directory
without putting anything in it. Remove this from the Makefile.

While at it, rename USRBINDIR variable USRSBINDIR (with an S) as it
refers to /usr/sbin.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2016-12-21 16:20:47 -05:00
Stephen Smalley
dd8d5671e2 libselinux: avcstat: Clean up redundant condition
dcb314 reported this via https://github.com/SELinuxProject/selinux/issues/20

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-29 11:11:26 -05:00
Stephen Smalley
bbc930c756 libselinux: fix subdir build and usage of cmdline CFLAGS
commit 16c123f4b1 ("libselinux:
support ANDROID_HOST=1 on Mac") broke the ability to run make
in the src subdirectory of libselinux (because OS and COMPILER
were not defined) and also caused some warning flags that could
be overridden via command-line CFLAGS to be mandatory.  Fix it.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-14 13:10:51 -05:00
William Roberts
e4f2bcce24 libselinux/utils: fix all the noreturn errors
When building with clang, multiple noreturn issues arise,
for instance:

selabel_partial_match.c:11:1: error: function 'usage' could be declared with attribute 'noreturn' [-Werror,-Wmissing-noreturn]

Fix these.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-11-01 17:29:49 -04:00
William Roberts
16c123f4b1 libselinux: support ANDROID_HOST=1 on Mac
To build on mac, first build libsepol with
no DESTDIR set.

Secondly, build libselinux with ANDROID_HOST=y

This configuration can be used to test the Android
host build on Mac.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-10-18 13:52:23 -04:00
William Roberts
d7b11d7e1c libselinux/utils: add noreturn to sefcontext_compile
When building on mac, one encounters this error:
sefcontext_compile.c:270:1: error: function 'usage' could be declared with attribute 'noreturn' [-Werror,-Wmissing-noreturn]

To correct this, add the attribute noreturn to the function.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-10-18 13:51:23 -04:00
Janis Danisevskis
6dd85b9e0e libselinux: android: fix lax service context lookup
We use the same lookup function for service contexts
that we use for property contexts. However, property
contexts are namespace based and only compare the
prefix. This may lead to service associations with
a wrong label.

This patch introduces a new back end for android
services with a stricter lookup function. Now the
service name must match the key of the service label
exactly.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-29 09:59:44 -04:00
William Roberts
b5dd7959d8 libselinux: add ANDROID_HOST=y build option
To build the selinux host configuration, specify
ANDROID_HOST=y on the Make command line.

eg)
make ANDROID_HOST=y
2016-09-28 12:22:15 -04:00
William Roberts
9b3e18ed4d libselinux: rename EMFLAGS to DISABLE_FLAGS
Change EMFLAGS variable, used for setting additional CFLAGS
to DISABLE_FLAGS, to indicate its usage better.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 12:07:13 -04:00
William Roberts
fba72330dd libselinux: drop DISABLE_BOOL=y option
Build option DISABLE_BOOL=y is not being used, and is broken, drop it.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 11:45:58 -04:00
William Roberts
42ab513703 libselinux: drop DISABLE_AVC=y
Remove build config DISABLE_AVC, it is unused and broken.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-09-28 11:43:36 -04:00
Janis Danisevskis
36df37555b libselinux: sefcontext_compile invert semantics of "-r" flag
The "-r" flag of sefcontext_compile now causes it to omit the
precompiled regular expressions from the output.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:54:01 -04:00
Janis Danisevskis
487d652e71 libselinux: sefcontext_compile: Add "-i" flag
Adds the "-i" flag, which prints the version and
architecture identifier of the regular expression back end.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:52:49 -04:00
Janis Danisevskis
3b68c6f9e9 libselinux: Add architecture string to file_context.bin
Serialized precompiled regular expressins are architecture
dependent when using PCRE2. This patch
- bumps the SELINUX_COMPILED_FCONTEXT version to 5 and
- adds a field to the output indicating the architecture
  compatibility.

libselinux can cope with an architecture mismatch by
ignoring the precompiled data in the input file and recompiling
the regular expressions at runtime. It can also load older
versions of file_contexts.bin if they where built with
sefcontext_compile using the exact same version of the
pcre1/2 as selinux.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:51:58 -04:00
Stephen Smalley
2c0b12699d sefcontext_compile: do not fail silently
sefcontext_compile was failing silently on various error paths.
Generate a suitable error message to stderr for each error.

Before:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
<no output, although non-zero exit status>

After:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
sefcontext_compile: mkstemp /path/to/unwritabledirectory/file_contexts.binNmQJqa failed: Permission denied

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-09-26 15:25:12 -04:00
Nicolas Iooss
8647a6c621 libselinux: silent -Wsign-compare warnings
When building libselinux with gcc and many warning flags, the build
fails with the following errors:

    selinux_restorecon.c: In function ‘selinux_restorecon’:
    selinux_restorecon.c:784:36: error: comparison between signed and
    unsigned integer expressions [-Werror=sign-compare]
       if (!flags.ignore_digest && size == fc_digest_len &&
                                        ^~

    selabel_digest.c: In function ‘main’:
    selabel_digest.c:162:16: error: comparison between signed and
    unsigned integer expressions [-Werror=sign-compare]
      for (i = 0; i < digest_len; i++)
                    ^
    selabel_digest.c:173:17: error: comparison between signed and
    unsigned integer expressions [-Werror=sign-compare]
       for (i = 0; i < num_specfiles; i++) {
                     ^

clang reports the precise type information of the variables:

    selinux_restorecon.c:784:36: error: comparison of integers of
    different signs: 'ssize_t' (aka 'long') and 'size_t' (aka 'unsigned
    long') [-Werror,-Wsign-compare]
                if (!flags.ignore_digest && size == fc_digest_len &&
                                            ~~~~ ^  ~~~~~~~~~~~~~

    selabel_digest.c:162:16: error: comparison of integers of different
    signs: 'int' and 'size_t' (aka 'unsigned long')
    [-Werror,-Wsign-compare]
            for (i = 0; i < digest_len; i++)
                        ~ ^ ~~~~~~~~~~
    selabel_digest.c:173:17: error: comparison of integers of different
    signs: 'int' and 'size_t' (aka 'unsigned long')
    [-Werror,-Wsign-compare]
                    for (i = 0; i < num_specfiles; i++) {
                                ~ ^ ~~~~~~~~~~~~~

Silent the warnings by using size_t where appropriate.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2016-09-26 11:00:31 -04:00
Janis Danisevskis
6ff294a002 sefcontext_compile: cleanup confusing usage message
Signed-off-by: Janis Danisevskis <jdanis@google.com>
2016-09-21 12:38:15 -04:00
Janis Danisevskis
50f0910cf0 libselinux: add support for pcre2
This patch moves all pcre1/2 dependencies into the new files regex.h
and regex.c implementing the common denominator of features needed
by libselinux. The compiler flag -DUSE_PCRE2 toggles between the
used implementations.

As of this patch libselinux supports either pcre or pcre2 but not
both at the same time. The persistently stored file contexts
information differs. This means libselinux can only load file
context files generated by sefcontext_compile build with the
same pcre variant.

Also, for pcre2 the persistent format is architecture dependent.
Stored precompiled regular expressions can only be used on the
same architecture they were generated on. If pcre2 is used,
sefcontext_compile now respects the "-r". This flag makes
sefcontext_compile include the precompiled regular expressions
in the output file. The default is to omit them, so that the
output remains portable at the cost of having to recompile
the regular expressions at load time, or rather on first use.

Signed-off-by: Janis Danisevskis <jdanis@google.com>
2016-09-15 13:49:14 -04:00
Stephen Smalley
6e2bdb770f libselinux, sefcontext_compile: handle NULL pcre study data
pcre_study() can return a NULL result if no additional information
could be determined for the pattern.  Thus, sefcontext_compile
needs to correctly handle the case where the study data is NULL
when generating file_contexts.bin, and libselinux needs to correctly
handle it when loading file_contexts.bin.  Fix them both.

This change enables:
semanage fcontext -a -t httpd_exec_t "(/.*)?"
to succeed, since the regex itself is valid but there is no
additional information produced by pcre_study().

Reported-by: Vit Mojzis <vmojzis@redhat.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-08-17 15:05:48 -04:00
Richard Haines
f2e77865e1 libselinux: Add setfiles support to selinux_restorecon(3)
Add additional error handling, flags, xdev handling, alt_rootpath and
add/remove non-seclabel fs's to support setfiles(8), restorecon(8)
and restorecond(8) functionality.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2016-08-11 14:33:55 -04:00
Richard Haines
d4a46eec3f libselinux: Evaluate inodes in selinux_restorecon(3)
This patch adds inode evaluation services from policycoreutiles/setfiles
to selinux_restorecon.c

The overall objective is to modify restorecon(8) and setfiles(8)
to use selinux_restorecon(3) services.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2016-08-11 14:33:51 -04:00
Laurent Bigonville
46c4f3a716 libselinux/utils/Makefile: Fix in tree compilation
Some tools need the sepol/sepol.h header
2016-08-04 08:54:15 -04:00
Nicolas Iooss
8e30f76c6d Update .gitignore files
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2016-05-09 08:14:54 -04:00
Richard Haines
bdd4e6d2b1 libselinux: Add selinux_restorecon function
The selinux_restorecon(3) man page details this function.

It has been built using the work from Android where an SHA1 hash
of the specfiles is held in an extended attribute to enhance
performance. Also contains components from policycoreutils/setfiles.

The utils/selinux_restorecon.c utility demonstrates the functionality.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2016-02-17 09:12:50 -05:00
Richard Haines
c1db824828 libselinux: Replace selabel_digest hash function
This replaces the openssl library with SHA1 hash functions
extracted from [1] as this is a public domain implementation.

util/selabel_digest -v option still compares the result with
the openssl command "openssl dgst -sha1 -hex .." for validation.

[1] https://github.com/WaterJuice/CryptLib

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-10-22 11:55:02 -04:00
Richard Haines
e0456053d0 libselinux: Fix selabel_open(3) services if no digest requested
If selabel_open is called with no request for a digest it will fail
with ENOENT. This fixes all the labeling routines to resolve this
problem. The utils/selabel_digest example has also been updated
to allow calling selabel_open with and without digest requests to
aid testing.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-10-15 12:13:42 -04:00
Richard Haines
e40bbea95f libselinux: Add selabel_digest function
selabel_digest(3) if enabled by the SELABEL_OPT_DIGEST option during
selabel_open(3) will return an SHA1 digest of the spec files, plus
a list of the specfiles used to calculate the digest. There is a
test utility supplied that will demonstrate the functionality.

The use case for selabel_digest(3) is to implement an selinux_restorecon
function based on the Android version that writes a hash of the
file_contexts files to an extended attribute to enhance performance
(see external/libselinux/src/android.c selinux_android_restorecon()).

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-10-13 17:13:24 -04:00
Richard Haines
50640d313d libselinux: Add policy context validation to sefcontext_compile
Add -p option that will take a binary policy file to validate
context entries in the text file_contexts file.

Should validation fail the binary file will not be written.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-25 14:49:13 -04:00
Richard Haines
f309a0e88c libselinux: Fix binary file labels for regexes with metachars
File labels assigned using the lookup_best_match() function do not
assign the best match if its regex contains metacharacters in the
binary file_contexts file version.

This change adds a new entry in the binary file with the calculated
prefix length that is then read when processing the file. This fix
also bumps SELINUX_COMPILED_FCONTEXT_MAX_VERS.

This patch relies on patch [1] that fixes the same problem
for text based file_contexts files.

[1] http://marc.info/?l=selinux&m=143576498713964&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-07-06 11:09:12 -04:00
Stephen Smalley
aab9d90b35 libselinux: Correctly handle an empty file_contexts file.
If you add some local file contexts via semanage fcontext -a and
later delete them all via semanage fcontext -D, you get an empty
file_contexts.local file.  Then when you try to load it, getline()
returns 0 and we fall through to the out path without having set rc.
In label_file.c, rc will always be non-zero at this point because
we will have failed the load_mmap() call.  In sefcontext_compile,
rc may contain random garbage at this point.  Explicitly set rc
before the loop.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-22 09:11:33 -04:00
Richard Haines
3cb6078ae5 libselinux: Enhance file context support
Update file contexts generation and loading to use common code.

Remove "status = 0; after "status = sort_specs(data);" otherwise
the function will never indicate a failure.

The file labeling code also has minor formatting, white space
removal etc. changes.

label_file.c - Move process_line function to label_file.h
sefcontext_compile.c - Update to use common process_line code. Now frees
all malloc'ed memory, checked by valgrind. Also added optional -o output
file parameter - updated man page to reflect this change.

V2 - Revert to using compat_validate instead of selabel_validate.
V3 - Revert to using callback for validation now the problem has been
fixed by commit e889148494
("libselinux:  build sefcontext_compile with static libselinux")

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-16 12:30:08 -04:00
Stephen Smalley
e889148494 libselinux: build sefcontext_compile with static libselinux
sefcontext_compile depends on libselinux internals, so it might
as well use static libselinux.  Hide read_spec_entries as this is not
intended as a public interface for shared library users.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-15 15:25:42 -04:00
Richard Haines
af41e2b5ff libselinux: Add read_spec_entries function to replace sscanf
Currently sscanf is used with %ms parameters that are not supported
on all platforms. The new read_spec_entries function may be used
to replace these where required. This patch updates
sefcontext_compile, label_file and label_android_property services
to use the new function.

The file and property services have been tested on Android emulator
and the file service on Fedora 21.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-03 10:43:33 -04:00
Richard Haines
f233d01015 libselinux: Support consistent mode size for bin files
Currently sefcontext_compile defines the mode field as mode_t whose
size will vary depending on the architecture (e.g. 32 bit / 64 bit).
This patch sets the size when writing/reading binary files to
uint32_t. The file version is set to SELINUX_COMPILED_FCONTEXT_MODE

V2 fixes those listed in http://marc.info/?l=selinux&m=143273965514292&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-27 12:22:32 -04:00