testing for disable-dontaudit in C code

testing for disable-dontaudit in C code

[Ted Toth]

Is there a way to test whether semodule has be run with
disable-dontaudit? Or better yet a netlink socket event?

Ted

Re: testing for disable-dontaudit in C code

[Stephen Smalley]

[-- Attachment #1: Type: text/plain, Size: 537 bytes --]

On Tue, Mar 24, 2020 at 11:15 AM Ted Toth <txtoth@gmail.com> wrote:
>
> Is there a way to test whether semodule has be run with
> disable-dontaudit? Or better yet a netlink socket event?

Something like this?

$ make LDLIBS+=-lsemanage checkdisabledontaudit
$ sudo semodule -DB
$ sudo ./checkdisabledontaudit
dontaudits disabled
$ sudo semodule -B
$ sudo ./checkdisabledontaudit
dontaudits enabled

There isn't a specific netlink notification, although you could
register for the selinux policyload
notifications and check at that time.

[-- Attachment #2: checkdisabledontaudit.c --]
[-- Type: text/x-csrc, Size: 541 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <semanage/handle.h>

int main(int argc, char **argv)
{
	semanage_handle_t *sh;
	int rc;

	sh = semanage_handle_create();
	if (!sh) {
		fprintf(stderr, "%s: Could not create semanage handle\n",
			argv[0]);
		exit(1);
	}

	rc = semanage_connect(sh);
	if (rc < 0) {
		fprintf(stderr, "%s: Could not connect to policy handler\n",
			argv[0]);
		exit(1);
	}

	rc = semanage_get_disable_dontaudit(sh);
	if (rc)
		printf("dontaudits disabled\n");
	else
		printf("dontaudits enabled\n");
	exit(0);
}

Re: testing for disable-dontaudit in C code

[Ted Toth]

On Tue, Mar 24, 2020 at 11:39 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, Mar 24, 2020 at 11:15 AM Ted Toth <txtoth@gmail.com> wrote:
> >
> > Is there a way to test whether semodule has be run with
> > disable-dontaudit? Or better yet a netlink socket event?
>
> Something like this?
>
> $ make LDLIBS+=-lsemanage checkdisabledontaudit
> $ sudo semodule -DB
> $ sudo ./checkdisabledontaudit
> dontaudits disabled
> $ sudo semodule -B
> $ sudo ./checkdisabledontaudit
> dontaudits enabled
>
> There isn't a specific netlink notification, although you could
> register for the selinux policyload
> notifications and check at that time.

Exactly, thank you.

Ted