aboutsummaryrefslogtreecommitdiffstats
path: root/libselinux/src/label_file.c
Commit message (Collapse)AuthorAgeFilesLines
* Restorecon: Ignore the stem when looking up all matches in file contextxunchang2019-03-151-15/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The stem is a list of top level directory (without regex metachar) covered in the file context. And it constructs from finding the second '/' in the regex_string; and aims to speed up the lookup by skipping unnecessary regex matches. More contexts in https://lore.kernel.org/selinux/200309231522.25749.russell@coker.com.au/ However, this caused some issue when we try to find all the partial matches for a root directory. For example, the path "/data" doesn't have a stem while the regex "/data/misc/(/.*)?" has "/data" as the stem. As a result, all the regex for the subdirs of /data will not considered as a match for "/data". And the restorecon will wrongly skip on top level "/data" when there's a context change to one of subdir. This CL always includes the stem when compiling the regex in all circumstances. Also, it ignores the stem id check in the "match all" case, while the behavior for the single match stays unchanged. I will collect more data to find out if stem id check is still necessary at all with the new restorecon logic. Bug: 62302954 Bug: 127946548 Test: run restorecon on "/data"; change the context of one subdir and run again, and the context is restored on that subdir; search the caller of regex_match Change-Id: I4d6e554bb6abe124055782769d2f95083ed6c3a1
* Restorecon: factor out a lookup helper for context matchesxunchang2019-03-051-20/+90
| | | | | | | | | | This is part of the effort to save digest for subdirectories. Split out the non-android part to make the merge to upstream branch easier. Bug: 62302954 Test: build android, compile the upstream branch Change-Id: I4df94ed381f26356c539d604f31a65daabafc1da
* Merge remote-tracking branch 'aosp/upstream-master' into mymergeNick Kralevich2019-02-141-1/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | Followed the following steps: # In repo client cd external/selinux repo sync . repo start mymerge . git merge aosp/upstream-master --no-ff # resolve any conflicts repo upload . Test: device compiles and boots Change-Id: If92a0b5e99e69ac0434197fa848b736b9cf0bf77
| * libselinux: Fix RESOURCE_LEAK defects reported by coverity scanPetr Lautrbach2019-02-101-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: libselinux/src/checkAccess.c:93: leaked_storage: Variable "user_context" going out of scope leaks the storage it points to. libselinux/src/label_db.c:286: leaked_storage: Variable "filp" going out of scope leaks the storage it points to. libselinux/src/label_db.c:291: leaked_storage: Variable "filp" going out of scope leaks the storage it points to. libselinux/src/label_file.c:405: leaked_storage: Variable "str_buf" going out of scope leaks the storage it points to. libselinux/src/load_policy.c:266: leaked_storage: Variable "names" going out of scope leaks the storage it points to. libselinux/src/selinux_config.c:183: leaked_storage: Variable "end" going out of scope leaks the storage it points to. libselinux/src/selinux_config.c:184: overwrite_var: Overwriting "end" in "end = type + strlen(type) - 1" leaks the storage that "end" points to. libselinux/src/selinux_restorecon.c:376: leaked_storage: Variable "new_entry" going out of scope leaks the storage it points to. libselinux/src/selinux_restorecon.c:855: leaked_storage: Variable "xattr_value" going out of scope leaks the storage it points to. Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
* | Merge remote-tracking branch 'aosp/upstream-master' into mymergeNick Kralevich2018-11-051-1/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular, pulls in https://github.com/SELinuxProject/selinux/commit/3f99b14939ec616ef59f62887e2532cd89409a3e which is needed for b/118685852 Followed the following steps: # In repo client cd external/selinux repo sync . repo start mymerge . git merge aosp/upstream-master --no-ff # resolve any conflicts repo upload . Bug: 118685852 Test: Android compiles and no obvious problems. Change-Id: Ic8f1bb2b573a1491b733732653afd7dbe494c85f
| * libselinux: fix overly strict validation of file_contexts.binStephen Smalley2018-11-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | load_mmap and regex_load_mmap (in the !USE_PCRE2 case) were incorrectly treating the absence of any fixed stems or study data as an error, rejecting valid file_contexts.bin files. Remove the extraneous validation checks. Test: $ cat > file_contexts <<EOF (/.*)? u:object_r:system_file:s0 /lib u:object_r:system_dir:s0 EOF $ sefcontext_compile file_contexts $ selabel_lookup -b file -k /lib -f file_contexts.bin Before: ERROR: selabel_open - Could not obtain handle. After: Default context: u:object_r:system_dir:s0 Reported-by: Jiyong Park <jiyong@google.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
| * Revert "libselinux: verify file_contexts when using restorecon"Stephen Smalley2018-04-201-1/+1
| | | | | | | | | | | | | | | | | | | | This reverts commit 814631d3aebaa041073a42c677c1ed62ce7830d5. As reported by Petr Lautrbach, this commit changed the behavior of selabel_open() when SELABEL_OPT_VALIDATE is 0, and this would be an API change. Reported-by: Petr Lautrbach <plautrba@redhat.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
| * libselinux: verify file_contexts when using restoreconYuli Khodorkovskiy2018-04-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In permissive mode, calling restorecon with a bad label in file_contexts does not verify the label's existence in the loaded policy. This results in any label successfully applying to a file, as long as the file exists. This issue has two assumptions: 1) file_contexts must be manually updated with the invalid label. Running `semanage fcontext` will error when attempting to add an invalid label to file_contexts. 2) the system must be in permissive. Although applying an invalid label in enforcing gives an error and fails, successfully labeling a file with a bad label could cause issues during policy development in permissive. Instead, as each context is used, verify it is valid before blindly applying the label. If an error with validation occurs in restorecon, application of remaining valid labels will be uninterrupted as before. Signed-off-by: Yuli Khodorkovskiy <ykhodo@gmail.com>
* | libselinux: fix build warningliuchao2017-12-201-0/+2
| | | | | | | | | | | | | | Fix build warning -Wunused-function & -Wunused-variable Test: Build Test Change-Id: I7f949709309163e81e9d1133c5103be92cc14de8
* | Merge remote-tracking branch 'aosp/upstream-master' into mymergeDan Cashman2017-08-071-8/+172
|\| | | | | | | | | | | Bug: 63861738 Test: Builds 'n' boots Change-Id: Idfb333d4cc1568dd2273f74731f12d52a413c07b
| * libselinux: fix thread safety issues with lookup_common()Tom Cherry2017-07-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two problems with lookup_common() and therefore selabel_lookup() and related functions that this patch fixes: 1) A race with the lazy compilation of regexes. Since the struct regex_data is allocated and assigned immediately to the parent struct spec, it's possible for a second thread to see that this pointer is non-NULL before the regex compilation has finished. This typically results in a -1 return from selabel_lookup() with ENOENT as errno. This is fixed by adding synchronization in compile_regex(). 2) A race with PCRE2 regex_match(). A struct pcre2_match_data is created once and used for all regex matches for a given regex. This is problematic if two threads are attempting to evaluate the same regex simultaneously. This typically results in a successful return from selabel_lookup() but with an erroneous selabel. This is fixed by adding a pthread_mutex within regex_match() for PCRE2. Note, on my system, creating new matchdata takes roughly an order of magnitude more time than locking a non-contended pthread_mutex. I don't believe programs will have enough contention on this lock to justify that cost. Bug: 63861738 Test: ueventd unit tests Change-Id: I13bf782d81d0a0b896d444e396f307ad0dbacb6a
| * libselinux: fix selabel_lookup*() double slash bugStephen Smalley2017-06-011-4/+155
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As originally reported in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863854 , "systemd-hwdb --usr update" was assigning /lib/udev/hwdb.bin the wrong security context. This turned out to be a result of systemd-hwdb calling selabel_lookup_raw() with a path with a leading double slash (//lib/udev/hwdb.bin). While the selabel file backend already removes duplicate slashes, this was occurring after any substitution matching and replacement had occurred in the generic selabel frontend, and thus the double slash was still preventing the /lib -> /usr/lib substitution specified by file_contexts.subs_dist from occurring. As a consequence, the final path (/lib/udev/hwdb.bin) used to look up did not match the /usr/lib/udev/[^/]* entry in file_contexts. There were two options for resolving: 1) move the double slash removal to the selabel frontend code before substitutions, or 2) move the substitution processing to the selabel file backend code after double slash removal. Since substitutions are currently only supported for the file backend, and since the slash character may have no particular meaning in the keys for other backends, it seems more correct to do the latter. This has the advantage of taking all of the substitution data structures and code private to the selabel file backend. Test case: Compare the output of: selabel_lookup -r -b file -k //lib/udev/hwdb.bin versus: selabel_lookup -r -b file -k /lib/udev/hwdb.bin Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863854 Reported-by: Russell Coker <russell@coker.com.au> Reported-by: Michael Biebl <biebl@debian.org> Reported-by: Laurent Bigonville <bigon@debian.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
| * libselinux: propagate selabel_subs_init() errorsNicolas Iooss2017-05-181-7/+17
| | | | | | | | | | | | | | | | | | | | | | | | Memory allocation failures in selabel_subs_init() should be fatal, contrary to failures which come from the non-existence of the substitution files (subs or subs_dist). Modify selabel_subs_init()'s prototype in order to return the error state. This forces the pointer to the created substitution list to be moved to an output function argument. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
| * libselinux: rework selabel_subs_init() to avoid use-after-freeNicolas Iooss2017-05-181-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In selabel_subs_init(), when digest_add_specfile() fails, the returned value is a pointer to data which has been freed (because label "err" frees variable "sub" which is equals to the returned variable, "list"). Moreover since since commit fd56c5230cea ("Separate out the calling of local subs and dist subs in selabel_sub"), argument "list" of selabel_subs_init() has always been NULL (rec->subs and rec->dist_subs are both initialized to NULL in selabel_open() before selabel_file_init() is called). Drop selabel_file_init()'s "list" argument and free all the list items which have been allocated in this function, when the code encounters an error. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
* | Merge remote-tracking branch 'aosp/upstream-master' into mymergeJeff Vander Stoep2017-04-121-1/+1
|\| | | | | | | | | | | Bug: 36508258 Test: build and boot Marlin. Change-Id: Ic5f92ad304dca23ddbfaaffd86489f3a556f9a1e
| * libselinux: add O_CLOEXECNick Kralevich2017-04-121-1/+1
| | | | | | | | | | | | | | Makes libselinux safer and less likely to leak file descriptors when used as part of a multithreaded program. Signed-off-by: Nick Kralevich <nnk@google.com>
* | Process file_contexts in the same order as specifiedJeff Vander Stoep2017-02-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When multiple file_contexts file paths are specified [1], read in and process files in the order specified. The load order of regexes matters. We expect platform provided regexes before device-specific customizations. Loading device policy first causes Marlin to not boot. [1] https://android-review.googlesource.com/#/c/332384/, Change-Id: I0608a898d8c81dcbf47b9cdf8eec33a6b0a20a5f Bug: 33746608 Test: Marlin builds and boots with the CL in [1].
* | Add ability to specify multiple input files to the selabel_open.dcashman2017-01-041-26/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The file_contexts labeling backend, specified in label_file.c, currently assumes that only one path will be specified as an option to selabel_open(). The split of platform and non-platform policy on device, however, will necessitate the loading of two disparate policy files. Rather than combining the files and then calling the existing API on a newly-formed file, just add the ability to specify multiple files to use. Order of opt specification to selabel_open matters. update: Fixed a double-free in the original change that caused the updater to randomly crash during OTA (b/33938747) Bug: 31363362 Bug: 33938747 Test: Device builds and boots w/no additional denials with split context files. Test: Angler can successfully finish sideloaded OTA with updater binary that is with this change Change-Id: I85cd1525990f6ad054861e62327bd9c2aac03b02 Signed-off-by: Daniel Cashman <dcashman@google.com> Signed-off-by: Sandeep Patil <sspatil@google.com>
* | Revert "Add ability to specify multiple input files to the selabel_open."Tianjie Xu2016-12-291-66/+26
| | | | | | | | | | | | This reverts commit da7b3079f5053dc233b83c570362cb29db8ab2c5. Change-Id: I1c9aebcedead1473720ab26102f12d71d7edbee5
* | Add ability to specify multiple input files to the selabel_open.dcashman2016-12-221-26/+66
|/ | | | | | | | | | | | | The file_contexts labeling backend, specified in label_file.c, currently assumes that only one path will be specified as an option to selabel_open(). The split of platform and non-platform policy on device, however, will necessitate the loading of two disparate policy files. Rather than combining the files and then calling the existing API on a newly-formed file, just add the ability to specify multiple files to use. Order of opt specification to selabel_open matters. Bug: 31363362 Test: Device builds and boots w/no additional denials with split context files. Change-Id: I85cd1525990f6ad054861e62327bd9c2aac03b02
* libselinux: fix unused variable errorWilliam Roberts2016-09-281-1/+1
| | | | | | | | | | | When building for Android, this error manifests itself: label_file.c:570:7: error: unused variable ‘subs_file’ [-Werror=unused-variable] char subs_file[PATH_MAX + 1]; Fix it by moving the variable into the ifdef'd usage block. Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux: Add architecture string to file_context.binJanis Danisevskis2016-09-281-1/+42
| | | | | | | | | | | | | | | | | Serialized precompiled regular expressins are architecture dependent when using PCRE2. This patch - bumps the SELINUX_COMPILED_FCONTEXT version to 5 and - adds a field to the output indicating the architecture compatibility. libselinux can cope with an architecture mismatch by ignoring the precompiled data in the input file and recompiling the regular expressions at runtime. It can also load older versions of file_contexts.bin if they where built with sefcontext_compile using the exact same version of the pcre1/2 as selinux. Signed-off-by: Janis Danisevskis <jdanis@android.com>
* libselinux: add ifdef'ing for ANDROID and BUILD_HOSTWilliam Roberts2016-09-261-0/+2
| | | | | | | | | | | | | | | On Android, certain discrepancies arise for unused functionality or for dealing with the differences in Bionic libc. This patch includes all the "ifdef'ing" required and introduces the BUILD_HOST define. The BUILD_HOST define removes functionality not needed when building libselinux for the Android build host machine. Note that not all the libselinux src files are used to build the host and target libraries on Android. Change-Id: I7984e7b769c4dfa627d6cf311411fa2c93bb7ef7 Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux: drop unused stdio_ext.h header fileWilliam Roberts2016-09-261-1/+0
| | | | | | | | | Nothing was being used from the stdio_ext.h header file, so remove it. Additionally, Mac builds, required for the Android build, do not have this header. Change-Id: Ic61c87fcda79ffebeef93a20a2b3802f048bb0b0 Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux: correct error path to always try textWilliam Roberts2016-09-191-15/+32
| | | | | | | | | | | | | | | | | | | patch 5e15a52aaa cleans up the process_file() routine, but introduced a bug. If the binary file cannot be opened, always attempt to fall back to the textual file, this was not occurring. The logic should be: 1. Open the newest file between base path + suffix and base_path + suffix + ".bin" 2. If anything fails, attempt to load the oldest file. The result, with a concrete example, would be: If file_contexts is the newest file, and it cannot be processed, the code will fall back to file_contexts.bin and vice versa. Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux: add support for pcre2Janis Danisevskis2016-09-151-72/+20
| | | | | | | | | | | | | | | | | | | | | | | | This patch moves all pcre1/2 dependencies into the new files regex.h and regex.c implementing the common denominator of features needed by libselinux. The compiler flag -DUSE_PCRE2 toggles between the used implementations. As of this patch libselinux supports either pcre or pcre2 but not both at the same time. The persistently stored file contexts information differs. This means libselinux can only load file context files generated by sefcontext_compile build with the same pcre variant. Also, for pcre2 the persistent format is architecture dependent. Stored precompiled regular expressions can only be used on the same architecture they were generated on. If pcre2 is used, sefcontext_compile now respects the "-r". This flag makes sefcontext_compile include the precompiled regular expressions in the output file. The default is to omit them, so that the output remains portable at the cost of having to recompile the regular expressions at load time, or rather on first use. Signed-off-by: Janis Danisevskis <jdanis@google.com>
* libselinux: fix coding style problems with the prior commitStephen Smalley2016-09-091-7/+10
| | | | Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: clean up process fileWilliam Roberts2016-09-091-144/+166
| | | | | | | | | | | | | | | | | | | | | The current process_file() code will open the file twice on the case of a binary file, correct this. The general flow through process_file() was a bit difficult to read, streamline the routine to be more readable. Detailed statistics of before and after: Source lines of code reported by cloc on modified files: before: 735 after: 742 Object size difference: before: 195530 bytes after: 195485 bytes Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux, sefcontext_compile: handle NULL pcre study dataStephen Smalley2016-08-171-11/+14
| | | | | | | | | | | | | | | | pcre_study() can return a NULL result if no additional information could be determined for the pattern. Thus, sefcontext_compile needs to correctly handle the case where the study data is NULL when generating file_contexts.bin, and libselinux needs to correctly handle it when loading file_contexts.bin. Fix them both. This change enables: semanage fcontext -a -t httpd_exec_t "(/.*)?" to succeed, since the regex itself is valid but there is no additional information produced by pcre_study(). Reported-by: Vit Mojzis <vmojzis@redhat.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: label_file: fix memory leaks and uninitialized jumpWilliam Roberts2015-10-281-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some error's were reported by valgrind (below) fix them. The test cases on which these leaks were detected: 1. properly formed file_contexts file. 2. malformed file_contexts file, unknown type. 3. malformed file_contexts file, type that fails on validate callback. 4. malformed file_contexts file, invalid regex. 5. malformed file_contexts file, invalid mode. ==3819== Conditional jump or move depends on uninitialised value(s) ==3819== at 0x12A682: closef (label_file.c:577) ==3819== by 0x12A196: selabel_close (label.c:163) ==3819== by 0x10A2FD: cleanup (checkfc.c:218) ==3819== by 0x5089258: __run_exit_handlers (exit.c:82) ==3819== by 0x50892A4: exit (exit.c:104) ==3819== by 0x10A231: main (checkfc.c:361) ==3819== Uninitialised value was created by a heap allocation ==3819== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==3819== by 0x4C2CF1F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==3819== by 0x12BB31: process_file (label_file.h:273) ==3819== by 0x12A2BA: selabel_file_init (label_file.c:522) ==3819== by 0x12A0BB: selabel_open (label.c:88) ==3819== by 0x10A038: main (checkfc.c:292) ==3819== ==3819== ==3819== HEAP SUMMARY: ==3819== in use at exit: 729 bytes in 19 blocks ==3819== total heap usage: 21,126 allocs, 21,107 frees, 923,854 bytes allocated ==3819== ==3819== 81 bytes in 1 blocks are definitely lost in loss record 1 of 2 ==3819== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==3819== by 0x50D5839: strdup (strdup.c:42) ==3819== by 0x12A2A6: selabel_file_init (label_file.c:517) ==3819== by 0x12A0BB: selabel_open (label.c:88) ==3819== by 0x10A038: main (checkfc.c:292) ==3819== ==4238== 40 bytes in 1 blocks are definitely lost in loss record 1 of 6 ==4238== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x12A1D2: selabel_file_init (label_file.c:886) ==4238== by 0x12A0BB: selabel_open (label.c:88) ==4238== by 0x10A038: main (checkfc.c:292) ==4238== ==4238== 81 bytes in 1 blocks are definitely lost in loss record 2 of 6 ==4238== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x50D5839: strdup (strdup.c:42) ==4238== by 0x12A2A6: selabel_file_init (label_file.c:517) ==4238== by 0x12A0BB: selabel_open (label.c:88) ==4238== by 0x10A038: main (checkfc.c:292) ==4238== ==4238== 386 bytes in 24 blocks are definitely lost in loss record 3 of 6 ==4238== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x50D5889: strndup (strndup.c:45) ==4238== by 0x12CDDF: read_spec_entries (label_support.c:37) ==4238== by 0x12B72D: process_file (label_file.h:392) ==4238== by 0x12A2BA: selabel_file_init (label_file.c:522) ==4238== by 0x12A0BB: selabel_open (label.c:88) ==4238== by 0x10A038: main (checkfc.c:292) ==4238== ==4238== 648 bytes in 18 blocks are definitely lost in loss record 4 of 6 ==4238== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x117C9B: avtab_insert_node (avtab.c:105) ==4238== by 0x117C10: avtab_insert (avtab.c:163) ==4238== by 0x11880A: avtab_read_item (avtab.c:566) ==4238== by 0x118BD3: avtab_read (avtab.c:600) ==4238== by 0x125BDD: policydb_read (policydb.c:3854) ==4238== by 0x109F87: main (checkfc.c:273) ==4238== ==4238== 1,095 bytes in 12 blocks are definitely lost in loss record 5 of 6 ==4238== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x12D8D1: pcre_compile2 (pcre_compile.c:9217) ==4238== by 0x12B239: compile_regex (label_file.h:357) ==4238== by 0x12B9C7: process_file (label_file.h:429) ==4238== by 0x12A2BA: selabel_file_init (label_file.c:522) ==4238== by 0x12A0BB: selabel_open (label.c:88) ==4238== by 0x10A038: main (checkfc.c:292) ==4238== ==4238== 1,296 bytes in 12 blocks are definitely lost in loss record 6 of 6 ==4238== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4238== by 0x13EBE5: pcre_study (pcre_study.c:1565) ==4238== by 0x12B25D: compile_regex (label_file.h:366) ==4238== by 0x12B9C7: process_file (label_file.h:429) ==4238== by 0x12A2BA: selabel_file_init (label_file.c:522) ==4238== by 0x12A0BB: selabel_open (label.c:88) ==4238== by 0x10A038: main (checkfc.c:292) Signed-off-by: William Roberts <william.c.roberts@intel.com>
* libselinux: Fix selabel_open(3) services if no digest requestedRichard Haines2015-10-151-3/+1
| | | | | | | | | | If selabel_open is called with no request for a digest it will fail with ENOENT. This fixes all the labeling routines to resolve this problem. The utils/selabel_digest example has also been updated to allow calling selabel_open with and without digest requests to aid testing. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Add selabel_digest functionRichard Haines2015-10-131-12/+31
| | | | | | | | | | | | | | selabel_digest(3) if enabled by the SELABEL_OPT_DIGEST option during selabel_open(3) will return an SHA1 digest of the spec files, plus a list of the specfiles used to calculate the digest. There is a test utility supplied that will demonstrate the functionality. The use case for selabel_digest(3) is to implement an selinux_restorecon function based on the Android version that writes a hash of the file_contexts files to an extended attribute to enhance performance (see external/libselinux/src/android.c selinux_android_restorecon()). Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Fix mmap memory release for file labelingRichard Haines2015-09-151-6/+6
| | | | | | | Ensure the mmap start address and length are not modified so the memory used can be released when selabel_close(3) is called. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: do not treat an empty file_contexts(.local) as an errorStephen Smalley2015-08-071-3/+7
| | | | | | | | | | | | | file_contexts can be legitimately empty, particularly when dealing with a file_contexts.local file. The change to test for file_contexts.bin format by magic number was treating an EOF condition as a fatal error, thereby causing an error on empty file_contexts.local files. Only treat it as an error if there was truly an error on the read, as checked via ferror(). Otherwise, clear the error and EOF indicators so that they do not persist when we rewind the file and try to read it as text. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: support context validation on file_contexts.binStephen Smalley2015-08-061-0/+8
| | | | | | | If file_contexts.bin was opened with SELABEL_OPT_VALIDATE set, then we should validate contexts in the same manner as with file_contexts. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: test for file_contexts.bin formatStephen Smalley2015-08-061-4/+21
| | | | | | | | | | | Check to see if the file whose path is passed to selabel_open() starts with the file_contexts.bin magic number, and if so, automatically treat it as a file_contexts.bin file. This allows one to open file_contexts.bin formatted files without necessarily having a .bin file suffix. This removes the need for the previously added .bin file suffix test. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: add selabel_cmp interface and label_file backendStephen Smalley2015-08-061-0/+92
| | | | | | | | | | | | | Add a selabel_cmp() interface for comparing two label configurations, and implement it for the file backend (i.e. for file_contexts). This allows comparing two file_contexts configurations to see if the first is a subset of, equal/identical to, a superset of, or incomparable to the second. The motivating use case is to allow comparing two file_contexts.bin files in Android CTS to confirm that a device file_contexts.bin file contains all of the entries in the AOSP general file_contexts. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: support specifying file_contexts.bin file pathStephen Smalley2015-08-051-3/+10
| | | | | | | | | | | | At present, the label_file backend expects to be provided the path to the text file_contexts file and always appends the .bin suffix when checking for the binary file_contexts.bin file. If one attempts to directly specify the path to a file_contexts.bin file to selabel_open(), it will fail as the code will append a second .bin suffix to it. Check to see if the file path already has a .bin suffix and do not append it in that case. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: support file_contexts.bin without file_contextsStephen Smalley2015-08-051-9/+21
| | | | | | | | | Change the label_file backend in libselinux to support systems that only have file_contexts.bin files installed and do not ship a file_contexts file at all. Only fail if neither file can be loaded. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: Add const to selinux_opt for label backends.Richard Haines2015-07-101-3/+4
| | | | | | | | Change selabel_open and label backends to take a 'const struct selinux_opt' argument. This work has already been done for the Android version components. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Fix binary file labels for regexes with metacharsRichard Haines2015-07-061-1/+10
| | | | | | | | | | | | | | | | | File labels assigned using the lookup_best_match() function do not assign the best match if its regex contains metacharacters in the binary file_contexts file version. This change adds a new entry in the binary file with the calculated prefix length that is then read when processing the file. This fix also bumps SELINUX_COMPILED_FCONTEXT_MAX_VERS. This patch relies on patch [1] that fixes the same problem for text based file_contexts files. [1] http://marc.info/?l=selinux&m=143576498713964&w=2 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Correctly handle an empty file_contexts file.Stephen Smalley2015-06-221-1/+2
| | | | | | | | | | | | | If you add some local file contexts via semanage fcontext -a and later delete them all via semanage fcontext -D, you get an empty file_contexts.local file. Then when you try to load it, getline() returns 0 and we fall through to the out path without having set rc. In label_file.c, rc will always be non-zero at this point because we will have failed the load_mmap() call. In sefcontext_compile, rc may contain random garbage at this point. Explicitly set rc before the loop. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: Enhance file context supportRichard Haines2015-06-161-152/+19
| | | | | | | | | | | | | | | | | | | | | | Update file contexts generation and loading to use common code. Remove "status = 0; after "status = sort_specs(data);" otherwise the function will never indicate a failure. The file labeling code also has minor formatting, white space removal etc. changes. label_file.c - Move process_line function to label_file.h sefcontext_compile.c - Update to use common process_line code. Now frees all malloc'ed memory, checked by valgrind. Also added optional -o output file parameter - updated man page to reflect this change. V2 - Revert to using compat_validate instead of selabel_validate. V3 - Revert to using callback for validation now the problem has been fixed by commit e88914849490c3fc17b0e5ed67387e47f2701d3c ("libselinux: build sefcontext_compile with static libselinux") Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Drop confusing comment.Stephen Smalley2015-06-081-3/+0
| | | | | | | | | | | | | | When Eamon created label_file.c, he drew code from the setfiles program, which I originally wrote. At the time, setfiles had a comment about being derived in part from the setfiles.pl script written by SCC, so Eamon put a comment in label_file.c that tried to preserve that lineage. However, there was no real code lineage there. The setfiles program was inspired by the setfiles.pl perl script, but the implementation was a complete rewrite. And while label_file.c drew some data structures and code from the setfiles C program, it had nothing to do with the setfiles.pl script at all. Just drop the comment; it serves no purpose. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* libselinux: Add read_spec_entries function to replace sscanfRichard Haines2015-06-031-11/+5
| | | | | | | | | | | | | Currently sscanf is used with %ms parameters that are not supported on all platforms. The new read_spec_entries function may be used to replace these where required. This patch updates sefcontext_compile, label_file and label_android_property services to use the new function. The file and property services have been tested on Android emulator and the file service on Fedora 21. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Support consistent mode size for bin filesRichard Haines2015-05-271-1/+7
| | | | | | | | | | | Currently sefcontext_compile defines the mode field as mode_t whose size will vary depending on the architecture (e.g. 32 bit / 64 bit). This patch sets the size when writing/reading binary files to uint32_t. The file version is set to SELINUX_COMPILED_FCONTEXT_MODE V2 fixes those listed in http://marc.info/?l=selinux&m=143273965514292&w=2 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* Fix more bin file processing core dumpsRichard Haines2015-05-261-73/+153
| | | | | | | | | | | | | | | | | | | | | | | | | The reading of bin files has been changed to follow that of loading policy to catch over-runs. Entries that should be NUL terminated are also checked. If any error, then process the text file. This should fix all problems highlighted in [1] with V2 fixing those in [2]. V3 corrects int32_t/uint32_t for *_len entries and V4 fixes [3] and adds pcre_fullinfo checks to validate regex and study data sizes. pcre_fullinfo also validates its magic number. Tested with bin files built using sefcontext_compile PCRE_VERS 1 and 2. The following is a rough guide to the difference in processing a bin file against a text file: 6K entries - x5 4K entries - x4 1K entries - x3 500 entries - x2 [1] http://marc.info/?l=selinux&m=143101983922281&w=2 [2] http://marc.info/?l=selinux&m=143161763905159&w=2 [3] http://marc.info/?l=selinux&m=143204170705586&w=2 Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Fix core dumps with corrupt *.bin filesRichard Haines2015-05-071-0/+10
| | | | | | | | | | | Check buffer address limits when processing *.bin files to catch any over-runs. On failure process text file instead. To test, the bin files were corrupted by adding and removing various bits of data. Various file sizes were also checked and all were caught by the patch. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
* libselinux: Add selabel partial and best match APIsRichard Haines2015-05-061-10/+99
| | | | | | | | | | | | Add support for new API functions selabel_partial_match and selabel_lookup_best_match ported from the Android libselinux fork. Add supporting man(3) pages and test utilities: selabel_lookup, selabel_lookup_best_match and selabel_partial_match. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Fix -Wformat errorsPetr Lautrbach2015-03-131-4/+4
| | | | | | | | | Fixes two types of errors which appear when building with gcc-5.0.0 - format ‘%d’ expects argument of type ‘int’, but argument X has type ‘unsigned int’ - format ‘%a’ expects argument of type ‘float *’, but argument X has type ‘char **’ Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-13 19:02:37 +0000