1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include "selinux_internal.h"
#include <stdlib.h>
#include <errno.h>
#include <limits.h>
#include <stdio.h>
#include <stdio_ext.h>
#include "policy.h"
int is_selinux_enabled(void)
{
char *buf=NULL;
FILE *fp;
ssize_t num;
size_t len;
int enabled = 0;
security_context_t con;
/* init_selinuxmnt() gets called before this function. We
* will assume that if a selinux file system is mounted, then
* selinux is enabled. */
if (selinux_mnt) {
/* Since a file system is mounted, we consider selinux
* enabled. If getcon_raw fails, selinux is still enabled.
* We only consider it disabled if no policy is loaded. */
enabled = 1;
if (getcon_raw(&con) == 0) {
if (!strcmp(con, "kernel"))
enabled = 0;
freecon(con);
}
return enabled;
}
/* Drop back to detecting it the long way. */
fp = fopen("/proc/filesystems", "r");
if (!fp)
return -1;
__fsetlocking(fp, FSETLOCKING_BYCALLER);
while ((num = getline(&buf, &len, fp)) != -1) {
if (strstr(buf, "selinuxfs")) {
enabled = 1;
break;
}
}
if (num < 0)
goto out;
/* Since an selinux file system is available, we consider
* selinux enabled. If getcon_raw fails, selinux is still
* enabled. We only consider it disabled if no policy is loaded. */
if (getcon_raw(&con) == 0) {
if (!strcmp(con, "kernel"))
enabled = 0;
freecon(con);
}
out:
free(buf);
fclose(fp);
return enabled;
}
hidden_def(is_selinux_enabled)
/*
* Function: is_selinux_mls_enabled()
* Return: 1 on success
* 0 on failure
*/
int is_selinux_mls_enabled(void)
{
char buf[20], path[PATH_MAX];
int fd, ret, enabled = 0;
if (!selinux_mnt)
return enabled;
snprintf(path, sizeof path, "%s/mls", selinux_mnt);
fd = open(path, O_RDONLY);
if (fd < 0)
return enabled;
memset(buf, 0, sizeof buf);
do {
ret = read(fd, buf, sizeof buf - 1);
} while (ret < 0 && errno == EINTR);
close(fd);
if (ret < 0)
return enabled;
if (!strcmp(buf, "1"))
enabled = 1;
return enabled;
}
hidden_def(is_selinux_mls_enabled)
|
