Commit Graph

22 Commits

Author SHA1 Message Date
Janis Danisevskis
36df37555b libselinux: sefcontext_compile invert semantics of "-r" flag
The "-r" flag of sefcontext_compile now causes it to omit the
precompiled regular expressions from the output.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:54:01 -04:00
Janis Danisevskis
487d652e71 libselinux: sefcontext_compile: Add "-i" flag
Adds the "-i" flag, which prints the version and
architecture identifier of the regular expression back end.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:52:49 -04:00
Janis Danisevskis
3b68c6f9e9 libselinux: Add architecture string to file_context.bin
Serialized precompiled regular expressins are architecture
dependent when using PCRE2. This patch
- bumps the SELINUX_COMPILED_FCONTEXT version to 5 and
- adds a field to the output indicating the architecture
  compatibility.

libselinux can cope with an architecture mismatch by
ignoring the precompiled data in the input file and recompiling
the regular expressions at runtime. It can also load older
versions of file_contexts.bin if they where built with
sefcontext_compile using the exact same version of the
pcre1/2 as selinux.

Signed-off-by: Janis Danisevskis <jdanis@android.com>
2016-09-28 07:51:58 -04:00
Stephen Smalley
2c0b12699d sefcontext_compile: do not fail silently
sefcontext_compile was failing silently on various error paths.
Generate a suitable error message to stderr for each error.

Before:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
<no output, although non-zero exit status>

After:
$ sefcontext_compile /path/to/unwritabledirectory/file_contexts
sefcontext_compile: mkstemp /path/to/unwritabledirectory/file_contexts.binNmQJqa failed: Permission denied

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-09-26 15:25:12 -04:00
Janis Danisevskis
6ff294a002 sefcontext_compile: cleanup confusing usage message
Signed-off-by: Janis Danisevskis <jdanis@google.com>
2016-09-21 12:38:15 -04:00
Janis Danisevskis
50f0910cf0 libselinux: add support for pcre2
This patch moves all pcre1/2 dependencies into the new files regex.h
and regex.c implementing the common denominator of features needed
by libselinux. The compiler flag -DUSE_PCRE2 toggles between the
used implementations.

As of this patch libselinux supports either pcre or pcre2 but not
both at the same time. The persistently stored file contexts
information differs. This means libselinux can only load file
context files generated by sefcontext_compile build with the
same pcre variant.

Also, for pcre2 the persistent format is architecture dependent.
Stored precompiled regular expressions can only be used on the
same architecture they were generated on. If pcre2 is used,
sefcontext_compile now respects the "-r". This flag makes
sefcontext_compile include the precompiled regular expressions
in the output file. The default is to omit them, so that the
output remains portable at the cost of having to recompile
the regular expressions at load time, or rather on first use.

Signed-off-by: Janis Danisevskis <jdanis@google.com>
2016-09-15 13:49:14 -04:00
Stephen Smalley
6e2bdb770f libselinux, sefcontext_compile: handle NULL pcre study data
pcre_study() can return a NULL result if no additional information
could be determined for the pattern.  Thus, sefcontext_compile
needs to correctly handle the case where the study data is NULL
when generating file_contexts.bin, and libselinux needs to correctly
handle it when loading file_contexts.bin.  Fix them both.

This change enables:
semanage fcontext -a -t httpd_exec_t "(/.*)?"
to succeed, since the regex itself is valid but there is no
additional information produced by pcre_study().

Reported-by: Vit Mojzis <vmojzis@redhat.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-08-17 15:05:48 -04:00
Richard Haines
50640d313d libselinux: Add policy context validation to sefcontext_compile
Add -p option that will take a binary policy file to validate
context entries in the text file_contexts file.

Should validation fail the binary file will not be written.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-08-25 14:49:13 -04:00
Richard Haines
f309a0e88c libselinux: Fix binary file labels for regexes with metachars
File labels assigned using the lookup_best_match() function do not
assign the best match if its regex contains metacharacters in the
binary file_contexts file version.

This change adds a new entry in the binary file with the calculated
prefix length that is then read when processing the file. This fix
also bumps SELINUX_COMPILED_FCONTEXT_MAX_VERS.

This patch relies on patch [1] that fixes the same problem
for text based file_contexts files.

[1] http://marc.info/?l=selinux&m=143576498713964&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-07-06 11:09:12 -04:00
Stephen Smalley
aab9d90b35 libselinux: Correctly handle an empty file_contexts file.
If you add some local file contexts via semanage fcontext -a and
later delete them all via semanage fcontext -D, you get an empty
file_contexts.local file.  Then when you try to load it, getline()
returns 0 and we fall through to the out path without having set rc.
In label_file.c, rc will always be non-zero at this point because
we will have failed the load_mmap() call.  In sefcontext_compile,
rc may contain random garbage at this point.  Explicitly set rc
before the loop.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-22 09:11:33 -04:00
Richard Haines
3cb6078ae5 libselinux: Enhance file context support
Update file contexts generation and loading to use common code.

Remove "status = 0; after "status = sort_specs(data);" otherwise
the function will never indicate a failure.

The file labeling code also has minor formatting, white space
removal etc. changes.

label_file.c - Move process_line function to label_file.h
sefcontext_compile.c - Update to use common process_line code. Now frees
all malloc'ed memory, checked by valgrind. Also added optional -o output
file parameter - updated man page to reflect this change.

V2 - Revert to using compat_validate instead of selabel_validate.
V3 - Revert to using callback for validation now the problem has been
fixed by commit e889148494
("libselinux:  build sefcontext_compile with static libselinux")

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-16 12:30:08 -04:00
Richard Haines
af41e2b5ff libselinux: Add read_spec_entries function to replace sscanf
Currently sscanf is used with %ms parameters that are not supported
on all platforms. The new read_spec_entries function may be used
to replace these where required. This patch updates
sefcontext_compile, label_file and label_android_property services
to use the new function.

The file and property services have been tested on Android emulator
and the file service on Fedora 21.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-06-03 10:43:33 -04:00
Richard Haines
f233d01015 libselinux: Support consistent mode size for bin files
Currently sefcontext_compile defines the mode field as mode_t whose
size will vary depending on the architecture (e.g. 32 bit / 64 bit).
This patch sets the size when writing/reading binary files to
uint32_t. The file version is set to SELINUX_COMPILED_FCONTEXT_MODE

V2 fixes those listed in http://marc.info/?l=selinux&m=143273965514292&w=2

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2015-05-27 12:22:32 -04:00
Petr Lautrbach
417cb8d076 Fix -Wformat errors
Fixes two types of errors which appear when building with gcc-5.0.0

- format ‘%d’ expects argument of type ‘int’, but argument X has type ‘unsigned int’
- format ‘%a’ expects argument of type ‘float *’, but argument X has type ‘char **’

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2015-03-13 14:14:23 -04:00
Stephen Smalley
ae44b7bb39 libselinux: sefcontext_compile: handle newlines in file names
restorecon on file names with newlines are not handled properly.
Use PCRE_DOTALL so that dots in regular expressions match all
characters, and don't exclude the newline character.

See https://www.mail-archive.com/seandroid-list@tycho.nsa.gov/msg02001.html
for background.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-02-24 12:20:42 -05:00
Nicolas Iooss
ae5de8ae69 libselinux: fix gcc -Wsign-compare warnings
Acked-by: Steve Lawrence <slawrence@tresys.com>
2014-10-02 09:56:11 -04:00
Dan Walsh
70b23853a8 libselinux: Compiled file context files and the original should have the same permissions
Currently the compiled file context files can end up with different
permissions then the original.  This can lead to non priv users
not being able to read the compiled versions.
2014-08-26 07:59:02 -04:00
Stephen Smalley
ac33098a80 Add pcre version string to the compiled file_contexts format.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-09 13:02:46 -04:00
Dan Walsh
874a976470 Fix handling of temporary file in sefcontext_compile.c
This way if something goes wrong regex file will not be corrupt.
2013-10-24 13:58:38 -04:00
Eric Paris
ce39302fd0 libselinux: sefcontext_compile: do not leak fd on error
We open the file which is to be used to write the binary format of file
contexts.  If we hit an error actually writing things out, we return,
but never close the fd.  Do not leak.

Signed-off-by: Eric Paris <eparis@redhat.com>
2013-02-05 20:21:52 -05:00
rhatdan
44cba24ba6 libselinux: sefcontontext_compile: Add error handling to help debug problems in libsemanage.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:57 -05:00
Eric Paris
dac8b32c17 libselinux: utils: new file context regex compiler
This is a new 'compiler' which tranforms the file context database into
a binary format.  This binary format may be mmap'd in later removing the
need to compile the regular expression at run time.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:56 -05:00