[libselinux] Add support for lxc contexts file
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Apr 19 20:34:34 UTC 2012
commit 40eaa6c9704cb399260f0ff6912f51b20e3e7fbf
Author: Dan Walsh <dwalsh at redhat.com>
Date: Thu Apr 19 16:34:27 2012 -0400
Add support for lxc contexts file
libselinux-rhat.patch | 277 +++++++++++++++++++++++++++++++++++++++++++++++-
libselinux.spec | 8 ++-
2 files changed, 278 insertions(+), 7 deletions(-)
---
diff --git a/libselinux-rhat.patch b/libselinux-rhat.patch
index c6a6088..4ac818f 100644
--- a/libselinux-rhat.patch
+++ b/libselinux-rhat.patch
@@ -15,7 +15,7 @@ index 1a54307..f6eeb21 100644
/*
* Label operations
diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
-index 6f483c9..fbcd3ac 100644
+index 6f483c9..9756ac9 100644
--- a/libselinux/include/selinux/selinux.h
+++ b/libselinux/include/selinux/selinux.h
@@ -139,7 +139,10 @@ struct av_decision {
@@ -50,6 +50,19 @@ index 6f483c9..fbcd3ac 100644
extern const char *selinux_binary_policy_path(void);
extern const char *selinux_failsafe_context_path(void);
extern const char *selinux_removable_context_path(void);
+@@ -502,10 +511,12 @@ extern const char *selinux_homedir_context_path(void);
+ extern const char *selinux_media_context_path(void);
+ extern const char *selinux_virtual_domain_context_path(void);
+ extern const char *selinux_virtual_image_context_path(void);
++extern const char *selinux_lxc_contexts_path(void);
+ extern const char *selinux_x_context_path(void);
+ extern const char *selinux_sepgsql_context_path(void);
+ extern const char *selinux_contexts_path(void);
+ extern const char *selinux_securetty_types_path(void);
++extern const char *selinux_booleans_subs_path(void);
+ extern const char *selinux_booleans_path(void);
+ extern const char *selinux_customizable_types_path(void);
+ extern const char *selinux_users_path(void);
diff --git a/libselinux/man/man3/matchpathcon.3 b/libselinux/man/man3/matchpathcon.3
index cdbb252..b6814ed 100644
--- a/libselinux/man/man3/matchpathcon.3
@@ -196,6 +209,206 @@ index be4c0a3..a07aa7f 100644
if (rc == 0 && !blocking) {
errno = EWOULDBLOCK;
+diff --git a/libselinux/src/booleans.c b/libselinux/src/booleans.c
+index 1510043..bf526c0 100644
+--- a/libselinux/src/booleans.c
++++ b/libselinux/src/booleans.c
+@@ -86,45 +86,131 @@ int security_get_boolean_names(char ***names, int *len)
+ }
+
+ hidden_def(security_get_boolean_names)
+-#define STRBUF_SIZE 3
+-static int get_bool_value(const char *name, char **buf)
++
++static char * bool_sub(const char *name)
+ {
+- int fd, len;
++ char *sub = NULL;
++ char *line_buf = NULL;
++ size_t line_len = 0;
++ FILE *cfg;
++
++ if (!name)
++ return NULL;
++
++ cfg = fopen(selinux_booleans_subs_path(), "r");
++
++ if (!cfg)
++ return NULL;
++
++ while (getline(&line_buf, &line_len, cfg)) {
++ char *ptr = NULL;
++ char *src = line_buf;
++ char *dst = NULL;
++
++ while (*src && isspace(*src))
++ src++;
++ if (src[0] == '#') continue;
++ ptr = src;
++ while (*ptr && ! isspace(*ptr))
++ ptr++;
++ *ptr++ = '\0';
++ if (! *src || (strcmp(src, name) != 0))
++ continue;
++
++ dst = ptr;
++ while (*dst && isspace(*dst))
++ dst++;
++ ptr=dst;
++ while (*ptr && ! isspace(*ptr))
++ ptr++;
++ *ptr='\0';
++ if (! *dst)
++ continue;
++
++ sub = strdup(dst);
++ break;
++ }
++
++ free(line_buf);
++ fclose(cfg);
++ return sub;
++}
++
++static int bool_open(const char *name, int flag) {
+ char *fname = NULL;
++ char *alt_name = NULL;
++ int len;
++ int fd = -1;
++ char *ptr;
+
+- if (!selinux_mnt) {
+- errno = ENOENT;
+- return -1;
++ if (!name) {
++ errno = EINVAL;
++ return fd;
+ }
+
+- *buf = (char *)malloc(sizeof(char) * (STRBUF_SIZE + 1));
+- if (!*buf)
+- goto out;
+- (*buf)[STRBUF_SIZE] = 0;
+-
+ len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
+ fname = (char *)malloc(sizeof(char) * len);
+ if (!fname)
+- goto out;
++ return fd;
++
+ snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name);
+
+- fd = open(fname, O_RDONLY);
+- if (fd < 0)
++ fd = open(fname, flag);
++ if (fd >= 0 || errno != ENOENT)
+ goto out;
+
+- len = read(fd, *buf, STRBUF_SIZE);
+- close(fd);
+- if (len != STRBUF_SIZE)
++ alt_name = bool_sub(name);
++ if (! alt_name)
+ goto out;
+
++ len = strlen(alt_name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
++ ptr = realloc(fname, len);
++ if (!ptr)
++ goto out;
++
++ fname = ptr;
++ snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, alt_name);
++ fd = open(fname, flag);
++
++out:
+ free(fname);
+- return 0;
++ free(alt_name);
++
++ return fd;
++}
++
++#define STRBUF_SIZE 3
++static int get_bool_value(const char *name, char **buf)
++{
++ int fd, len;
++ int rc = -1;
++ char *bool_buf = NULL;
++ if (!selinux_mnt) {
++ errno = ENOENT;
++ return -1;
++ }
++
++ fd = bool_open(name, O_RDONLY);
++ if (fd < 0)
++ return -1;
++
++ bool_buf = malloc(sizeof(char) * (STRBUF_SIZE + 1));
++ if (!bool_buf)
++ goto out;
++ bool_buf[STRBUF_SIZE] = 0;
++
++ len = read(fd, bool_buf, STRBUF_SIZE);
++ if (len != STRBUF_SIZE)
++ goto out;
++ rc = 0;
+ out:
+- if (*buf)
+- free(*buf);
+- if (fname)
+- free(fname);
+- return -1;
++ close(fd);
++ if (!rc) {
++ *buf = bool_buf;
++ } else {
++ free(bool_buf);
++ }
++ return rc;
+ }
+
+ int security_get_boolean_pending(const char *name)
+@@ -164,8 +250,8 @@ hidden_def(security_get_boolean_active)
+
+ int security_set_boolean(const char *name, int value)
+ {
+- int fd, ret, len;
+- char buf[2], *fname;
++ int fd, ret;
++ char buf[2];
+
+ if (!selinux_mnt) {
+ errno = ENOENT;
+@@ -176,17 +262,9 @@ int security_set_boolean(const char *name, int value)
+ return -1;
+ }
+
+- len = strlen(name) + strlen(selinux_mnt) + sizeof(SELINUX_BOOL_DIR);
+- fname = (char *)malloc(sizeof(char) * len);
+- if (!fname)
++ fd = bool_open(name, O_WRONLY);
++ if (fd < 0)
+ return -1;
+- snprintf(fname, len, "%s%s%s", selinux_mnt, SELINUX_BOOL_DIR, name);
+-
+- fd = open(fname, O_WRONLY);
+- if (fd < 0) {
+- ret = -1;
+- goto out;
+- }
+
+ if (value)
+ buf[0] = '1';
+@@ -196,8 +274,7 @@ int security_set_boolean(const char *name, int value)
+
+ ret = write(fd, buf, 2);
+ close(fd);
+- out:
+- free(fname);
++
+ if (ret > 0)
+ return 0;
+ else
diff --git a/libselinux/src/callbacks.c b/libselinux/src/callbacks.c
index b245364..7c47222 100644
--- a/libselinux/src/callbacks.c
@@ -208,6 +421,19 @@ index b245364..7c47222 100644
va_start(ap, fmt);
rc = vfprintf(stderr, fmt, ap);
va_end(ap);
+diff --git a/libselinux/src/file_path_suffixes.h b/libselinux/src/file_path_suffixes.h
+index 0b00156..825f295 100644
+--- a/libselinux/src/file_path_suffixes.h
++++ b/libselinux/src/file_path_suffixes.h
+@@ -22,6 +22,8 @@ S_(BINPOLICY, "/policy/policy")
+ S_(COLORS, "/secolor.conf")
+ S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context")
+ S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context")
++ S_(LXC_CONTEXTS, "/contexts/lxc_contexts")
+ S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs")
+ S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist")
+ S_(SEPGSQL_CONTEXTS, "/contexts/sepgsql_contexts")
++ S_(BOOLEAN_SUBS, "/booleans.subs")
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index 7bc46cc..82a608c 100644
--- a/libselinux/src/label_file.c
@@ -365,7 +591,7 @@ index 8f200d4..c18ea47 100644
int matchpathcon_init(const char *path)
diff --git a/libselinux/src/selinux_config.c b/libselinux/src/selinux_config.c
-index f42cb7c..907b004 100644
+index f42cb7c..f544ac2 100644
--- a/libselinux/src/selinux_config.c
+++ b/libselinux/src/selinux_config.c
@@ -9,6 +9,7 @@
@@ -376,7 +602,18 @@ index f42cb7c..907b004 100644
#include "get_default_type_internal.h"
#define SELINUXDIR "/etc/selinux/"
-@@ -301,6 +302,29 @@ const char *selinux_binary_policy_path(void)
+@@ -46,7 +47,9 @@
+ #define FILE_CONTEXT_SUBS 23
+ #define SEPGSQL_CONTEXTS 24
+ #define FILE_CONTEXT_SUBS_DIST 25
+-#define NEL 26
++#define BOOLEAN_SUBS 26
++#define LXC_CONTEXTS 27
++#define NEL 28
+
+ /* Part of one-time lazy init */
+ static pthread_once_t once = PTHREAD_ONCE_INIT;
+@@ -301,6 +304,29 @@ const char *selinux_binary_policy_path(void)
hidden_def(selinux_binary_policy_path)
@@ -406,19 +643,47 @@ index f42cb7c..907b004 100644
const char *selinux_file_context_path(void)
{
return get_path(FILE_CONTEXTS);
+@@ -418,6 +444,19 @@ const char *selinux_virtual_image_context_path(void)
+
+ hidden_def(selinux_virtual_image_context_path)
+
++const char *selinux_lxc_contexts_path(void)
++{
++ return get_path(LXC_CONTEXTS);
++}
++
++hidden_def(selinux_lxc_contexts_path)
++
++const char * selinux_booleans_subs_path(void) {
++ return get_path(BOOLEAN_SUBS);
++}
++
++hidden_def(selinux_booleans_subs_path)
++
+ const char * selinux_file_context_subs_path(void) {
+ return get_path(FILE_CONTEXT_SUBS);
+ }
diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h
-index 00df405..4db366a 100644
+index 00df405..8a935d0 100644
--- a/libselinux/src/selinux_internal.h
+++ b/libselinux/src/selinux_internal.h
-@@ -60,6 +60,7 @@ hidden_proto(selinux_mkload_policy)
+@@ -60,12 +60,15 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(security_setenforce)
hidden_proto(security_deny_unknown)
hidden_proto(selinux_binary_policy_path)
++ hidden_proto(selinux_booleans_subs_path)
+ hidden_proto(selinux_current_policy_path)
hidden_proto(selinux_default_context_path)
hidden_proto(selinux_securetty_types_path)
hidden_proto(selinux_failsafe_context_path)
-@@ -82,6 +83,7 @@ hidden_proto(selinux_mkload_policy)
+ hidden_proto(selinux_removable_context_path)
+ hidden_proto(selinux_virtual_domain_context_path)
+ hidden_proto(selinux_virtual_image_context_path)
++ hidden_proto(selinux_lxc_contexts_path)
+ hidden_proto(selinux_file_context_path)
+ hidden_proto(selinux_file_context_homedir_path)
+ hidden_proto(selinux_file_context_local_path)
+@@ -82,6 +85,7 @@ hidden_proto(selinux_mkload_policy)
hidden_proto(selinux_path)
hidden_proto(selinux_check_passwd_access)
hidden_proto(selinux_check_securetty_context)
diff --git a/libselinux.spec b/libselinux.spec
index bf4a53a..2bb12fc 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -8,7 +8,7 @@
Summary: SELinux library and simple utilities
Name: libselinux
Version: 2.1.10
-Release: 1%{?dist}
+Release: 3%{?dist}
License: Public Domain
Group: System Environment/Libraries
Source: %{name}-%{version}.tgz
@@ -233,6 +233,12 @@ rm -rf %{buildroot}
%{ruby_sitearch}/selinux.so
%changelog
+* Tue Apr 17 2012 Dan Walsh <dwalsh at redhat.com> - 2.1.10-3
+- Add support for lxc contexts file
+
+* Fri Mar 30 2012 Dan Walsh <dwalsh at redhat.com> - 2.1.10-2
+- Add support fot boolean subs file
+
* Thu Mar 29 2012 Dan Walsh <dwalsh at redhat.com> - 2.1.10-1
- Update to upstream
* Fix dead links to www.nsa.gov/selinux
More information about the scm-commits
mailing list