[PATCH] udev selinux fix

Here is a fix for the SELinux part of udev.

Setfscreatecon() overrides the default labeling behavior of SELinux when
creating files, so it should only be used for as short of a time as
possible, around the mknod or symlink calls.  Without this, the files in
udev_db get the wrong label because the fscreatecon is reset after the
udev_db file creation instead of before.  I'm guessing the Redhat people
missed this because they modify udev_db to be one big file instead of a
directory of small files (at least that's what I'm told).  I created
selinux_resetfscreatecon() to reset the fscreatecon asap after the
file/node is created.

Fixed a memory leak in selinux_init.  Getfscreatecon() allocates memory
for the context, and the udev code was immediately setting the pointer
(security_context_t is actually a typedef'ed char*) to NULL after the
call regardless of success/failure.  If you're wondering about the case
where there's effectively a setfscreatecon(NULL), this is ok, as its
used to tell SELinux to do the default labeling behavior.

Renamed selinux_restore() to selinux_exit() due to the changed behavior.

Fixed a couple of dbg() messages.

1 files changed, 17 insertions, 15 deletions

diff --git a/udev_selinux.c b/udev_selinux.c
index 72381f0d0d..cc6f4d7d3f 100644
--- a/udev_selinux.c
+++ b/udev_selinux.c
@@ -105,7 +105,7 @@ void selinux_setfilecon(const char *file, const char *devname, unsigned int mode
 			} 
 
 		if (setfilecon(file, scontext) < 0)
-			dbg("setfiles %s failed with error '%s'", file, strerror(errno));
+			dbg("setfilecon %s failed with error '%s'", file, strerror(errno));
 
 		freecon(scontext);
 	}
@@ -131,12 +131,20 @@ void selinux_setfscreatecon(const char *file, const char *devname, unsigned int
 			}
 
 		if (setfscreatecon(scontext) < 0)
-			dbg("setfiles %s failed with error '%s'", file, strerror(errno));
+			dbg("setfscreatecon %s failed with error '%s'", file, strerror(errno));
 
 		freecon(scontext);
 	}
 }
 
+void selinux_resetfscreatecon(void)
+{
+	if (is_selinux_running()) {
+		if (setfscreatecon(prev_scontext) < 0)
+			dbg("setfscreatecon %s failed with error '%s'", file, strerror(errno));
+	}
+}
+
 void selinux_init(void)
 {
 	/*
@@ -144,23 +152,17 @@ void selinux_init(void)
 	 * restoration creation purposes.
 	 */
 	if (is_selinux_running()) {
-		if (getfscreatecon(&prev_scontext) < 0)
+		if (getfscreatecon(&prev_scontext) < 0) {
 			dbg("getfscreatecon failed\n");
-
-		prev_scontext = NULL;
+			prev_scontext = NULL;
+		}
 	}
 }
 
-void selinux_restore(void)
+void selinux_exit(void)
 {
-	if (is_selinux_running()) {
-		/* reset the file create context to its former glory */
-		if (setfscreatecon(prev_scontext) < 0)
-			dbg("setfscreatecon failed\n");
-
-		if (prev_scontext) {
-			freecon(prev_scontext);
-			prev_scontext = NULL;
-		}
+	if (is_selinux_running() && prev_scontext) {
+		freecon(prev_scontext);
+		prev_scontext = NULL;
 	}
 }