Go to file
Stephen Smalley dc3d9c6d71
libsemanage: set selinux policy root around calls to selinux_boolean_sub
As reported in #109, semodule -p /path/to/policyroot -s minimum -n -B
tries to use /etc/selinux/targeted/booleans.subs_dist.  This is because
it invokes the libselinux selinux_boolean_sub() interface, which uses
the active/installed policy files rather than the libsemanage ones.

Switch the selinux policy root around the selinux_boolean_sub() call
to incorporate the semanage root as a prefix and to use the specified
policy store as a suffix so that the correct booleans.subs_dist file
(if any) is used.

The underlying bug is that booleans.subs_dist is not itself managed
via libsemanage. If it was managed and therefore lived within the
policy store, then libsemanage could access the appropriate
booleans.subs_dist file without using the libselinux interface at all,
and thus would not need to modify the selinux policy root.  Moving
booleans.subs_dist to a managed file is deferred to a future change.

Test:
dnf install selinux-policy-minimum selinux-policy-targeted
cd / && tar cf - etc/selinux var/lib/selinux | (cd ~/policy-root; tar xvpf -)
strace semodule -p ~/policy-root -s minimum -n -B

Before:
openat(AT_FDCWD, "/etc/selinux/targeted/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5

After:
openat(AT_FDCWD, "/home/sds/policy-root/etc/selinux/minimum/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5

Fixes https://github.com/SELinuxProject/selinux/issues/109

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2019-01-12 19:01:24 +01:00
checkpolicy checkpolicy: Add option to sort ocontexts when creating a binary policy 2018-10-12 13:38:00 -04:00
dbus dbus: remove deprecated at_console statement 2018-11-22 10:03:30 +01:00
gui gui: remove html_util.py 2018-11-22 10:03:49 +01:00
libselinux Makefile: add -Wstrict-overflow=5 to CFLAGS 2018-12-31 08:06:29 -08:00
libsemanage libsemanage: set selinux policy root around calls to selinux_boolean_sub 2019-01-12 19:01:24 +01:00
libsepol libsepol: ibpkeys.c: fix printf format string specifiers for subnet_prefix 2018-11-23 21:38:44 +01:00
mcstrans mcstrans: Fix check in raw_color() 2018-12-20 15:13:12 +01:00
policycoreutils policycoreutils/hll/pp: remove unused variable 2018-06-06 15:56:45 -04:00
python python: run all the tests with "make test" 2019-01-08 10:15:46 +01:00
restorecond restorecond: Do not ignore the -f option 2018-10-11 10:53:08 -04:00
sandbox Fix minor typos 2018-06-30 20:28:25 +02:00
scripts scripts/run-flake8: run on Python scripts not ending with .py 2019-01-08 13:21:09 +01:00
secilc secilc: better error handling 2018-09-25 08:05:41 -07:00
semodule-utils Update VERSIONs to 2.8 for release. 2018-05-24 14:21:09 -04:00
.gitignore restorecond: Add gitignore 2016-11-16 11:20:05 -05:00
.travis.yml Travis-CI: download refpolicy and install headers 2019-01-08 10:15:46 +01:00
CleanSpec.mk Add empty top level Android.mk / CleanSpec.mk files 2015-04-16 07:54:09 -04:00
Makefile build: setup buildpaths if DESTDIR is specified 2018-02-14 20:02:03 +01:00
README README: Update the SELinux mailing list location 2018-10-16 11:08:39 -04:00

Please submit all bug reports and patches to selinux@vger.kernel.org.
Subscribe by sending "subscribe selinux" in the body of an email
to majordomo@vger.kernel.org.

Build dependencies on Fedora:
yum install audit-libs-devel bison bzip2-devel dbus-devel dbus-glib-devel flex flex-devel flex-static glib2-devel libcap-devel libcap-ng-devel pam-devel pcre-devel python-devel setools-devel swig xmlto redhat-rpm-config

To build and install everything under a private directory, run:
make DESTDIR=~/obj install install-pywrap

To install as the default system libraries and binaries
(overwriting any previously installed ones - dangerous!),
on x86_64, run:
make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel
or on x86 (32-bit), run:
make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace
lacks library functions or other dependencies relied upon by your
distribution.  If it breaks, you get to keep both pieces.

To install libsepol on macOS (mainly for policy analysis):
cd libsepol; make PREFIX=/usr/local install

This requires GNU coreutils (brew install coreutils).