* [PATCH] libsemanage: set selinux policy root around calls to selinux_boolean_sub
@ 2019-01-07 16:59 Stephen Smalley
0 siblings, 0 replies; only message in thread
From: Stephen Smalley @ 2019-01-07 16:59 UTC (permalink / raw)
To: selinux; +Cc: Stephen Smalley
As reported in #109, semodule -p /path/to/policyroot -s minimum -n -B
tries to use /etc/selinux/targeted/booleans.subs_dist. This is because
it invokes the libselinux selinux_boolean_sub() interface, which uses
the active/installed policy files rather than the libsemanage ones.
Switch the selinux policy root around the selinux_boolean_sub() call
to incorporate the semanage root as a prefix and to use the specified
policy store as a suffix so that the correct booleans.subs_dist file
(if any) is used.
The underlying bug is that booleans.subs_dist is not itself managed
via libsemanage. If it was managed and therefore lived within the
policy store, then libsemanage could access the appropriate
booleans.subs_dist file without using the libselinux interface at all,
and thus would not need to modify the selinux policy root. Moving
booleans.subs_dist to a managed file is deferred to a future change.
Test:
strace semodule -p ~/policy-root -s minimum -n -B
Before:
openat(AT_FDCWD, "/etc/selinux/targeted/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5
After:
openat(AT_FDCWD, "/home/sds/policy-root/etc/selinux/minimum/booleans.subs_dist", O_RDONLY|O_CLOEXEC) = 5
Fixes https://github.com/SELinuxProject/selinux/issues/109
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
libsemanage/src/boolean_record.c | 44 ++++++++++++++++++++++++++++++--
1 file changed, 42 insertions(+), 2 deletions(-)
diff --git a/libsemanage/src/boolean_record.c b/libsemanage/src/boolean_record.c
index 665c0223..6840901d 100644
--- a/libsemanage/src/boolean_record.c
+++ b/libsemanage/src/boolean_record.c
@@ -6,6 +6,7 @@
* Implements: record_key_t (Database Record Key)
*/
+#include <string.h>
#include <sepol/boolean_record.h>
typedef sepol_bool_t semanage_bool_t;
@@ -84,10 +85,49 @@ hidden_def(semanage_bool_get_name)
int semanage_bool_set_name(semanage_handle_t * handle,
semanage_bool_t * boolean, const char *name)
{
- int rc;
- char *subname = selinux_boolean_sub(name);
+ int rc = -1;
+ const char *prefix = semanage_root();
+ const char *storename = handle->conf->store_path;
+ char *oldroot;
+ char *olddir;
+ char *subname = NULL;
+ char *newroot = NULL;
+ char *end;
+
+ oldroot = strdup(selinux_policy_root());
+ if (!oldroot)
+ return -1;
+ olddir = strdup(oldroot);
+ if (!olddir)
+ goto out;
+ end = strrchr(olddir, '/');
+ if (!end)
+ goto out;
+ end++;
+ *end = '\0';
+ rc = asprintf(&newroot, "%s%s%s", prefix, olddir, storename);
+ if (rc < 0)
+ goto out;
+ rc = selinux_set_policy_root(newroot);
+ if (rc)
+ goto out;
+
+ subname = selinux_boolean_sub(name);
+ if (!subname) {
+ rc = -1;
+ goto out;
+ }
+
+ rc = selinux_set_policy_root(oldroot);
+ if (rc)
+ goto out;
+
rc = sepol_bool_set_name(handle->sepolh, boolean, subname);
+out:
free(subname);
+ free(oldroot);
+ free(olddir);
+ free(newroot);
return rc;
}
--
2.20.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2019-01-07 16:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-07 16:59 [PATCH] libsemanage: set selinux policy root around calls to selinux_boolean_sub Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).