Re: Patch to policycoreutils

[Stephen Smalley <sds@tycho.nsa.gov>]

On Fri, 2005-01-28 at 15:25, Daniel J Walsh wrote:
> diff_filecontext() {
> if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
> 	TEMPFILE=`mktemp ${FILE_CONTEXT}.XXXXXXXXXX`
> 	test -z "$TEMPFILE" && exit
> 	/usr/bin/diff $PREFC $FILE_CONTEXT | egrep '^[<>]'|cut -c3-| grep ^/ | \
>         sed -e 's,\\.*,*,g' -e 's,(.*,*,g' -e 's,\[.*,*,g' -e 's,\..*,*,g' \
>             -e 's,[[:blank:]].*,,g' -e 's,\?.*,*,g' | sort -u | \
>         while read pattern ; do if ! echo "$pattern" | grep -q -f ${TEMPFILE} 2>/dev/null ; then echo "$pattern"; case "$pattern" in *"*") echo "$pattern" |sed 's,\*$,,g'>> ${TEMPFILE};;  esac; fi; done | \
> 	while read pattern ; do find $pattern -maxdepth 0 -print; done 2> /dev/null | \
> 	${RESTORECON} $2 -v -f -R - 
> 	rm -f ${TEMPFILE}
> fi
> }

To try to understand this better, I split the pipeline and wrote each
stage into a separate temporary file, then looked at diffs between each
pair of stages.  I'm not sure if the filter pipline is functioning as
you intend, e.g.:

1) The first sed substitution changes:
/var/tmp/vi\.recover  -d      system_u:object_r:tmp_t
to:
/var/tmp/vi*

A \. is not a regex; it is a regular dot character, so I would have
expected you to just remove the backslash for passing along to
restorecon. 

2) The second sed substitution changes:
/usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird --      system_u:object_r:bin_t
to:
/usr/lib*

This is due to sed itself performing regex matching for the .* sequence,
i.e. it consumes anything after an open parens.  Possibly you could
escape it if that is what you intended, e.g. \.\*.

Similar issues with the other substitutions that are using .*, I think,
e.g. changing:
/usr/bin/[xgkw]dm     --      system_u:object_r:xdm_exec_t
to:
/usr/bin/*

But the shell would have correctly handled /usr/bin/[xgkw]dm without any
change at all.

Also seems to have a problem with the /u?dev entries, changing:
/u?dev/microcode
to:
/u*

which won't actually catch /dev nodes.

-- 
Stephen Smalley <sds@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.