The "-r" flag of sefcontext_compile now causes it to omit the
precompiled regular expressions from the output.
Signed-off-by: Janis Danisevskis <jdanis@android.com>
Adds the "-i" flag, which prints the version and
architecture identifier of the regular expression back end.
Signed-off-by: Janis Danisevskis <jdanis@android.com>
Serialized precompiled regular expressins are architecture
dependent when using PCRE2. This patch
- bumps the SELINUX_COMPILED_FCONTEXT version to 5 and
- adds a field to the output indicating the architecture
compatibility.
libselinux can cope with an architecture mismatch by
ignoring the precompiled data in the input file and recompiling
the regular expressions at runtime. It can also load older
versions of file_contexts.bin if they where built with
sefcontext_compile using the exact same version of the
pcre1/2 as selinux.
Signed-off-by: Janis Danisevskis <jdanis@android.com>
7a728e46 commit supposed to add a warning when a module name is
different than a filename, but this warning is printed always. This
commit fixes it.
Fixes:
$ semodule -X 400 -i testmod.pp
Warning: SELinux userspace will refer to the module from testmod.pp as
testmod rather than testmod
Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
According to dbus upstream: "dbus-launch is fairly horrible code,
complicated by the historical need for it to support X11 autolaunching,
so the D-Bus maintainers would like to move it out of the critical path
and minimize its use."
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836289
Signed-off-by: Laurent Bigonville <bigon@bigon.be>
sefcontext_compile was failing silently on various error paths.
Generate a suitable error message to stderr for each error.
Before:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
<no output, although non-zero exit status>
After:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
sefcontext_compile: mkstemp /path/to/unwritabledirectory/file_contexts.binNmQJqa failed: Permission denied
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
On Android, certain discrepancies arise for unused functionality or
for dealing with the differences in Bionic libc. This patch includes
all the "ifdef'ing" required and introduces the BUILD_HOST define.
The BUILD_HOST define removes functionality not needed when building
libselinux for the Android build host machine.
Note that not all the libselinux src files are used to build
the host and target libraries on Android.
Change-Id: I7984e7b769c4dfa627d6cf311411fa2c93bb7ef7
Signed-off-by: William Roberts <william.c.roberts@intel.com>
On Android for both the host build, and the target, certain
backends are not needed:
- X Backend
- DB Backend
- Media Backend
Introduce the following defines for removing them from the
built library:
- NO_X_BACKEND
- NO_DB_BACKEND
- NO_MEDIA_BACKEND
When configured with these options and an attempt
is made to use them, selabel_open() will return
ENOTSUP.
Signed-off-by: William Roberts <william.c.roberts@intel.com>
This patch adds restorecon_xattr(8) to find and/or remove
security.restorecon_last entries added by setfiles(8) or
restorecon(8). Uses the services of selinux_restorecon_xattr(3).
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
This patch adds a new selinux_restorecon_xattr(3) function to find
and/or remove security.restorecon_last entries added by setfiles(8)
or restorecon(8).
Also review and update the man pages.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Add -D option to setfiles and restorecon - Do not set or update
directory SHA1 digests when relabeling files. This will allow
users the option of not using the "security.restorecon_last"
extended attribute feature.
Also review and update the man pages.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
When a user installs a module, the filename is used as the module name.
This change was introduced with CIL language where a module name is not
stored in the module itself. It means that when a pp module has
different filename and stored module name, the filename is used instead
of the stored module name. It brings problems with compatibility for
scripts and modules which were built and used on older system and were
migrated to the new userspace.
This patch changes the behavior of semanage_direct_install_file() which
is used by 'semodule -i' so that when a module with pp language
extension is installed, it tries to get and use a stored module name
instead of a filename. A warning message is provided.
The warning message in policycoreutils/hll/pp is updated to reflect this
change:
$ semodule -X 400 -i /root/testfile.pp
Warning: SELinux userspace will refer to the module from /root/testfile.pp as testmod rather than testfile
$ /usr/libexec/selinux/hll/pp /root/testfile.pp testfile.cil
Warning: SELinux userspace will refer to the module from /root/testfile.pp as testmod rather than testfile
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Mixing LDFLAGS in CFLAGS can lead to compiler errors. For example in
policycoreutils/sandbox:
$ make CC=clang LDFLAGS='-Wl,-as-needed,-no-undefined'
clang -Wl,-as-needed,-no-undefined -I/usr/include
-DPACKAGE="\"policycoreutils\"" -Wall -Werror -Wextra -W -c -o
seunshare.o seunshare.c
clang-3.8: error: -Wl,-as-needed,-no-undefined: 'linker' input
unused
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Allow using other compilers such as clang. Without this, the build fails
when $(CFLAGS) contains clang-specific flags:
gcc: error: unrecognized command line option '-Weverything'
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
When building libselinux with gcc and many warning flags, the build
fails with the following errors:
selinux_restorecon.c: In function ‘selinux_restorecon’:
selinux_restorecon.c:784:36: error: comparison between signed and
unsigned integer expressions [-Werror=sign-compare]
if (!flags.ignore_digest && size == fc_digest_len &&
^~
selabel_digest.c: In function ‘main’:
selabel_digest.c:162:16: error: comparison between signed and
unsigned integer expressions [-Werror=sign-compare]
for (i = 0; i < digest_len; i++)
^
selabel_digest.c:173:17: error: comparison between signed and
unsigned integer expressions [-Werror=sign-compare]
for (i = 0; i < num_specfiles; i++) {
^
clang reports the precise type information of the variables:
selinux_restorecon.c:784:36: error: comparison of integers of
different signs: 'ssize_t' (aka 'long') and 'size_t' (aka 'unsigned
long') [-Werror,-Wsign-compare]
if (!flags.ignore_digest && size == fc_digest_len &&
~~~~ ^ ~~~~~~~~~~~~~
selabel_digest.c:162:16: error: comparison of integers of different
signs: 'int' and 'size_t' (aka 'unsigned long')
[-Werror,-Wsign-compare]
for (i = 0; i < digest_len; i++)
~ ^ ~~~~~~~~~~
selabel_digest.c:173:17: error: comparison of integers of different
signs: 'int' and 'size_t' (aka 'unsigned long')
[-Werror,-Wsign-compare]
for (i = 0; i < num_specfiles; i++) {
~ ^ ~~~~~~~~~~~~~
Silent the warnings by using size_t where appropriate.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Nothing was being used from the stdio_ext.h header file, so
remove it. Additionally, Mac builds, required for the
Android build, do not have this header.
Change-Id: Ic61c87fcda79ffebeef93a20a2b3802f048bb0b0
Signed-off-by: William Roberts <william.c.roberts@intel.com>
Fix this:
genusers.c:63:14: warning: variable 'nread' is uninitialized when used here [-Wuninitialized]
if (buffer[nread - 1] == '\n')
^~~~~
genusers.c:40:15: note: initialize the variable 'nread' to silence this warning
ssize_t nread;
^
= 0
Signed-off-by: William Roberts <william.c.roberts@intel.com>
Fix this on Mac build:
genbools.c:71:9: warning: unused variable 'size' [-Wunused-variable]
size_t size = 0;
^
Signed-off-by: William Roberts <william.c.roberts@intel.com>
The next patch will update info() and search() to use the setools4 api.
setools4 makes heavy use of generators so info() and search() will as
well. Pre-emptively update users to cast to a list where required.
Signed-off-by: Jason Zaman <jason@perfinion.com>
search() is an overly complex wrapper around setools, several users are
simplified by just directly using setools.
Signed-off-by: Jason Zaman <jason@perfinion.com>
Drop the check for selinux_enabled() on logging. The
caller can silence the logs by setting the logging
callback and discarding the messages.
Change-Id: Ia6769ef7ad8cc2144ad2bb73e5bf7c76ebfe487b
Signed-off-by: William Roberts <william.c.roberts@intel.com>
sandbox tried to copy all affected files to the new home
or tmp even though -M or -X was not specified and there was no new
directory.
Fixes:
$ sandbox ls ~
/usr/bin/sandbox: [Errno 17] File exists: '/root'
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
_D_ALLOC_NAMLEN is not very portable. Currently, the code
mallocs based on _D_ALLOC_NAMLEN() and then strcpy's dirent
d_name into the buffer. Instead, just use strdup.
Change-Id: I5c8ca47da2c593ea2726caba5781f5e9d9d910ae
Signed-off-by: William Roberts <william.c.roberts@intel.com>
The file will initially contain:
run_init=run_init_t
There can not be any spaces around the = since OpenRC's existing config
files and the methods it uses require it.
Signed-off-by: Jason Zaman <jason@perfinion.com>
When the Kernel UAPI header is present, this error occurs:
external/selinux/libselinux/src/policy.h:7:9: warning: 'XATTR_NAME_SELINUX' macro redefined [-Wmacro-redefined]
\#define XATTR_NAME_SELINUX "security.selinux"
^
bionic/libc/kernel/uapi/linux/xattr.h:52:9: note: previous definition is here
\#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
Just use the kernel UAPI version on that case.
Change-Id: I1b2d34e463477adaec227ac8c3364f1b9d49e997
Signed-off-by: William Roberts <william.c.roberts@intel.com>
