Skip to content

verify file contexts during permissive and print line number on bad entry #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 4, 2018
Merged

verify file contexts during permissive and print line number on bad entry #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd5f796
libselinux: verify file_contexts when using restorecon
gitstashpop Mar 30, 2018
fe40c4b
libselinux: echo line number of bad label in selabel_fini()
gitstashpop Mar 30, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions libselinux/src/label.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,12 +121,11 @@ static inline int selabel_is_validate_set(const struct selinux_opt *opts,
return 0;
}

int selabel_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts)
int selabel_validate(struct selabel_lookup_rec *contexts)
{
int rc = 0;

if (!rec->validating || contexts->validated)
if (contexts->validated)
goto out;

rc = selinux_validate(&contexts->ctx_raw);
Expand All @@ -143,7 +142,7 @@ static int selabel_fini(struct selabel_handle *rec,
struct selabel_lookup_rec *lr,
int translating)
{
if (compat_validate(rec, lr, rec->spec_file, 0))
if (compat_validate(lr, rec->spec_file, lr->lineno))
return -1;

if (translating && !lr->ctx_trans &&
Expand Down
2 changes: 1 addition & 1 deletion libselinux/src/label_backends_android.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ static int process_line(struct selabel_handle *rec,
spec_arr[nspec].lr.ctx_raw = context;

if (rec->validating) {
if (selabel_validate(rec, &spec_arr[nspec].lr) < 0) {
if (selabel_validate(&spec_arr[nspec].lr) < 0) {
selinux_log(SELINUX_ERROR,
"%s: line %u has invalid context %s\n",
path, lineno, spec_arr[nspec].lr.ctx_raw);
Expand Down
2 changes: 1 addition & 1 deletion libselinux/src/label_file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,7 @@ static int load_mmap(FILE *fp, size_t len, struct selabel_handle *rec,
spec->lr.ctx_raw = str_buf;

if (strcmp(spec->lr.ctx_raw, "<<none>>") && rec->validating) {
if (selabel_validate(rec, &spec->lr) < 0) {
if (selabel_validate(&spec->lr) < 0) {
selinux_log(SELINUX_ERROR,
"%s: context %s is invalid\n",
path, spec->lr.ctx_raw);
Expand Down
3 changes: 2 additions & 1 deletion libselinux/src/label_file.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,6 +472,7 @@ static inline int process_line(struct selabel_handle *rec,
spec_arr[nspec].mode = 0;

spec_arr[nspec].lr.ctx_raw = context;
spec_arr[nspec].lr.lineno = lineno;

/*
* bump data->nspecs to cause closef() to cover it in its free
Expand Down Expand Up @@ -506,7 +507,7 @@ static inline int process_line(struct selabel_handle *rec,
spec_hasMetaChars(&spec_arr[nspec]);

if (strcmp(context, "<<none>>") && rec->validating)
return compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
return compat_validate(&spec_arr[nspec].lr, path, lineno);

return 0;
}
Expand Down
7 changes: 3 additions & 4 deletions libselinux/src/label_internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ struct selabel_lookup_rec {
char * ctx_raw;
char * ctx_trans;
int validated;
unsigned lineno;
};

struct selabel_handle {
Expand Down Expand Up @@ -111,8 +112,7 @@ struct selabel_handle {
* Validation function
*/
extern int
selabel_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts) hidden;
selabel_validate(struct selabel_lookup_rec *contexts) hidden;

/*
* Compatibility support
Expand All @@ -127,8 +127,7 @@ extern void __attribute__ ((format(printf, 1, 2)))
selinux_log(type, fmt);

extern int
compat_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts,
compat_validate(struct selabel_lookup_rec *contexts,
const char *path, unsigned lineno) hidden;

/*
Expand Down
5 changes: 2 additions & 3 deletions libselinux/src/matchpathcon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,7 @@ void set_matchpathcon_printf(void (*f) (const char *fmt, ...))
myprintf_compat = 1;
}

int compat_validate(struct selabel_handle *rec,
struct selabel_lookup_rec *contexts,
int compat_validate(struct selabel_lookup_rec *contexts,
const char *path, unsigned lineno)
{
int rc;
Expand All @@ -47,7 +46,7 @@ int compat_validate(struct selabel_handle *rec,
else if (mycanoncon)
rc = mycanoncon(path, lineno, ctx);
else {
rc = selabel_validate(rec, contexts);
rc = selabel_validate(contexts);
if (rc < 0) {
if (lineno) {
COMPAT_LOG(SELINUX_WARNING,
Expand Down