summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-10-23 18:34:58 +0200
committerLennart Poettering <lennart@poettering.net>2014-10-23 21:36:56 +0200
commit5dfc54615a1eacea18106383c964425cebd67c30 (patch)
tree7f6b1cbf4190a08c7b74adc79db2ee3d309b40b8 /src
parentd1ce2089b4b2fb1f1d8faba9a0aa6d9f8fbb0638 (diff)
smack: rework SMACK label fixing code to follow more closely the semantics of the matching selinux code
Diffstat (limited to 'src')
-rw-r--r--src/shared/label.c20
-rw-r--r--src/shared/mkdir-label.c2
-rw-r--r--src/shared/selinux-util.c19
-rw-r--r--src/shared/smack-util.c59
-rw-r--r--src/shared/smack-util.h2
5 files changed, 55 insertions, 47 deletions
diff --git a/src/shared/label.c b/src/shared/label.c
index eae6614969..38992be153 100644
--- a/src/shared/label.c
+++ b/src/shared/label.c
@@ -23,19 +23,15 @@
#include "util.h"
int label_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
- int r = 0;
+ int r, q;
- if (mac_selinux_use()) {
- r = mac_selinux_fix(path, ignore_enoent, ignore_erofs);
- if (r < 0)
- return r;
- }
+ r = mac_selinux_fix(path, ignore_enoent, ignore_erofs);
+ q = mac_smack_fix(path, ignore_enoent, ignore_erofs);
- if (mac_smack_use()) {
- r = mac_smack_fix(path);
- if (r < 0)
- return r;
- }
+ if (r < 0)
+ return r;
+ if (q < 0)
+ return q;
- return r;
+ return 0;
}
diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c
index 48941b3df4..81bc78c1e7 100644
--- a/src/shared/mkdir-label.c
+++ b/src/shared/mkdir-label.c
@@ -46,7 +46,7 @@ static int label_mkdir(const char *path, mode_t mode) {
if (r < 0 && errno != EEXIST)
return -errno;
- r = mac_smack_fix(path);
+ r = mac_smack_fix(path, false, false);
if (r < 0)
return r;
}
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index b1fdfab434..9707d0cefa 100644
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -113,22 +113,25 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
#ifdef HAVE_SELINUX
struct stat st;
- security_context_t fcon;
+ assert(path);
+
+ /* if mac_selinux_init() wasn't called before we are a NOOP */
if (!label_hnd)
return 0;
r = lstat(path, &st);
- if (r == 0) {
+ if (r >= 0) {
+ _cleanup_security_context_free_ security_context_t fcon = NULL;
+
r = selabel_lookup_raw(label_hnd, &fcon, path, st.st_mode);
/* If there's no label to set, then exit without warning */
if (r < 0 && errno == ENOENT)
return 0;
- if (r == 0) {
+ if (r >= 0) {
r = lsetfilecon(path, fcon);
- freecon(fcon);
/* If the FS doesn't support labels, then exit without warning */
if (r < 0 && errno == ENOTSUP)
@@ -144,8 +147,7 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
if (ignore_erofs && errno == EROFS)
return 0;
- log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
- "Unable to fix label of %s: %m", path);
+ log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, "Unable to fix SELinux label of %s: %m", path);
r = security_getenforce() == 1 ? -errno : 0;
}
#endif
@@ -156,11 +158,10 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
void mac_selinux_finish(void) {
#ifdef HAVE_SELINUX
- if (!mac_selinux_use())
+ if (!label_hnd)
return;
- if (label_hnd)
- selabel_close(label_hnd);
+ selabel_close(label_hnd);
#endif
}
diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
index c345488d2e..dd7e3be1b7 100644
--- a/src/shared/smack-util.c
+++ b/src/shared/smack-util.c
@@ -120,17 +120,14 @@ int mac_smack_apply_ip_in_fd(int fd, const char *label) {
return r;
}
-int mac_smack_fix(const char *path) {
+int mac_smack_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
int r = 0;
#ifdef HAVE_SMACK
- struct stat sb;
- const char *label;
-#endif
+ struct stat st;
assert(path);
-#ifdef HAVE_SMACK
if (!mac_smack_use())
return 0;
@@ -140,28 +137,42 @@ int mac_smack_fix(const char *path) {
if (!path_startswith(path, "/dev"))
return 0;
- r = lstat(path, &sb);
- if (r < 0)
- return -errno;
+ r = lstat(path, &st);
+ if (r >= 0) {
+ const char *label;
+
+ /*
+ * Label directories and character devices "*".
+ * Label symlinks "_".
+ * Don't change anything else.
+ */
+
+ if (S_ISDIR(st.st_mode))
+ label = SMACK_STAR_LABEL;
+ else if (S_ISLNK(st.st_mode))
+ label = SMACK_FLOOR_LABEL;
+ else if (S_ISCHR(st.st_mode))
+ label = SMACK_STAR_LABEL;
+ else
+ return 0;
- /*
- * Label directories and character devices "*".
- * Label symlinks "_".
- * Don't change anything else.
- */
- if (S_ISDIR(sb.st_mode))
- label = SMACK_STAR_LABEL;
- else if (S_ISLNK(sb.st_mode))
- label = SMACK_FLOOR_LABEL;
- else if (S_ISCHR(sb.st_mode))
- label = SMACK_STAR_LABEL;
- else
- return 0;
+ r = lsetxattr(path, "security.SMACK64", label, strlen(label), 0);
+
+ /* If the FS doesn't support labels, then exit without warning */
+ if (r < 0 && errno == ENOTSUP)
+ return 0;
+ }
- r = setxattr(path, "security.SMACK64", label, strlen(label), 0);
if (r < 0) {
- log_error("Smack relabeling \"%s\" %m", path);
- return -errno;
+ /* Ignore ENOENT in some cases */
+ if (ignore_enoent && errno == ENOENT)
+ return 0;
+
+ if (ignore_erofs && errno == EROFS)
+ return 0;
+
+ log_debug("Unable to fix SMACK label of %s: %m", path);
+ r = -errno;
}
#endif
diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h
index fe624f5f46..3dc28dd727 100644
--- a/src/shared/smack-util.h
+++ b/src/shared/smack-util.h
@@ -30,7 +30,7 @@
bool mac_smack_use(void);
-int mac_smack_fix(const char *path);
+int mac_smack_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
int mac_smack_apply(const char *path, const char *label);
int mac_smack_apply_fd(int fd, const char *label);