From: Stephen Smalley <sds@tycho.nsa.gov>
To: selinux@vger.kernel.org
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Subject: [PATCH] libsemanage: set selinux policy root around calls to selinux_boolean_sub
Date: Mon, 7 Jan 2019 11:59:19 -0500 [thread overview]
Message-ID: <20190107165919.17681-1-sds@tycho.nsa.gov> (raw)
As reported in #109, semodule -p /path/to/policyroot -s minimum -n -B
tries to use /etc/selinux/targeted/booleans.subs_dist. This is because
it invokes the libselinux selinux_boolean_sub() interface, which uses
the active/installed policy files rather than the libsemanage ones.
Switch the selinux policy root around the selinux_boolean_sub() call
to incorporate the semanage root as a prefix and to use the specified
policy store as a suffix so that the correct booleans.subs_dist file
(if any) is used.
The underlying bug is that booleans.subs_dist is not itself managed
via libsemanage. If it was managed and therefore lived within the
policy store, then libsemanage could access the appropriate
booleans.subs_dist file without using the libselinux interface at all,
and thus would not need to modify the selinux policy root. Moving
booleans.subs_dist to a managed file is deferred to a future change.
Test:
strace semodule -p ~/policy-root -s minimum -n -B
Before:
openat(AT_FDCWD, "/etc/selinux/targeted/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5
After:
openat(AT_FDCWD, "/home/sds/policy-root/etc/selinux/minimum/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5
Fixes https://github.com/SELinuxProject/selinux/issues/109
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
libsemanage/src/boolean_record.c | 44 ++++++++++++++++++++++++++++++--
1 file changed, 42 insertions(+), 2 deletions(-)
diff --git a/libsemanage/src/boolean_record.c b/libsemanage/src/boolean_record.c
index 665c0223..6840901d 100644
--- a/libsemanage/src/boolean_record.c
+++ b/libsemanage/src/boolean_record.c
@@ -6,6 +6,7 @@
* Implements: record_key_t (Database Record Key)
*/
+#include <string.h>
#include <sepol/boolean_record.h>
typedef sepol_bool_t semanage_bool_t;
@@ -84,10 +85,49 @@ hidden_def(semanage_bool_get_name)
int semanage_bool_set_name(semanage_handle_t * handle,
semanage_bool_t * boolean, const char *name)
{
- int rc;
- char *subname = selinux_boolean_sub(name);
+ int rc = -1;
+ const char *prefix = semanage_root();
+ const char *storename = handle->conf->store_path;
+ char *oldroot;
+ char *olddir;
+ char *subname = NULL;
+ char *newroot = NULL;
+ char *end;
+
+ oldroot = strdup(selinux_policy_root());
+ if (!oldroot)
+ return -1;
+ olddir = strdup(oldroot);
+ if (!olddir)
+ goto out;
+ end = strrchr(olddir, '/');
+ if (!end)
+ goto out;
+ end++;
+ *end = '\0';
+ rc = asprintf(&newroot, "%s%s%s", prefix, olddir, storename);
+ if (rc < 0)
+ goto out;
+ rc = selinux_set_policy_root(newroot);
+ if (rc)
+ goto out;
+
+ subname = selinux_boolean_sub(name);
+ if (!subname) {
+ rc = -1;
+ goto out;
+ }
+
+ rc = selinux_set_policy_root(oldroot);
+ if (rc)
+ goto out;
+
rc = sepol_bool_set_name(handle->sepolh, boolean, subname);
+out:
free(subname);
+ free(oldroot);
+ free(olddir);
+ free(newroot);
return rc;
}
--
2.20.1
reply other threads:[~2019-01-07 16:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190107165919.17681-1-sds@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).