[PATCH V3 0/2] Update restorecon to support new digest scheme

[PATCH V3 0/2] Update restorecon to support new digest scheme

[Richard Haines]

These patches require [1] and [2] be installed first. They have
been implemented on Android and sent to the selinux list, however their
merge has been deferred. They will install the core hashing of
file_context entries and fix root stem processing.

Patch 1/2 updates selinux_restorecon() replacing the per-mountpoint
security.restorecon_last attribute with a per-directory security.sehash
attribute computed from only those file contexts entries that partially
match the directory. This is to avoid the need to walk the entire tree
when any part of file_contexts changes, limiting relabels to only those
parts of the tree that could have changed.

One change is to add a new selabel_get_digests_all_partial_matches(3)
function that is explained in the man page. This could replace the Android
version of selabel_hash_all_partial_matches(3), that could then be
converted into a local function (The Android team would need to approve).

The patch [3] "selinux-testsuite: Add test for restorecon" will test these
changes.

Patch 1/2 Changes:
V2 Change:
Restore using SELABEL_OPT_DIGEST
V3 Change:
Replace memcpy in get_digests_all_partial_matches() to overcome error
flagged by -D_FORTIFY_SOURCE= when building only libselinux.

Patch 2/2 Changes:
V2 Change
Keep restorecon(8) and setfiles(8) as they were for compatibility
 
[1] https://lore.kernel.org/selinux/20190311222442.49824-1-xunchang@google.com/
[2] https://lore.kernel.org/selinux/20190417180955.136942-1-xunchang@google.com/
[3] https://lore.kernel.org/selinux/20190603095609.21429-1-richard_c_haines@btinternet.com/

Richard Haines (2):
  libselinux: Save digest of all partial matches for directory
  setfiles: Update utilities for the new digest scheme

 libselinux/include/selinux/label.h            |   5 +
 libselinux/include/selinux/restorecon.h       |  17 +-
 .../selabel_get_digests_all_partial_matches.3 |  70 +++++
 libselinux/man/man3/selinux_restorecon.3      |  81 +++---
 .../man/man3/selinux_restorecon_xattr.3       |   8 +-
 libselinux/src/label.c                        |  15 +
 libselinux/src/label_file.c                   |  62 ++++
 libselinux/src/label_file.h                   |   4 +
 libselinux/src/label_internal.h               |   5 +
 libselinux/src/selinux_restorecon.c           | 271 ++++++++++++------
 libselinux/utils/.gitignore                   |   1 +
 .../selabel_get_digests_all_partial_matches.c | 170 +++++++++++
 policycoreutils/setfiles/restorecon.8         |  10 +-
 policycoreutils/setfiles/restorecon_xattr.8   |  20 +-
 policycoreutils/setfiles/restorecon_xattr.c   |   2 +-
 policycoreutils/setfiles/setfiles.8           |  10 +-
 16 files changed, 591 insertions(+), 160 deletions(-)
 create mode 100644 libselinux/man/man3/selabel_get_digests_all_partial_matches.3
 create mode 100644 libselinux/utils/selabel_get_digests_all_partial_matches.c

-- 
2.21.0

[PATCH V3 0/2] Update restorecon to support new digest scheme

[Richard Haines]

These patches require [1] and [2] be installed first. They have
been implemented on Android and sent to the selinux list, however their
merge has been deferred. They will install the core hashing of
file_context entries and fix root stem processing.

Patch 1/2 updates selinux_restorecon() replacing the per-mountpoint
security.restorecon_last attribute with a per-directory security.sehash
attribute computed from only those file contexts entries that partially
match the directory. This is to avoid the need to walk the entire tree
when any part of file_contexts changes, limiting relabels to only those
parts of the tree that could have changed.

One change is to add a new selabel_get_digests_all_partial_matches(3)
function that is explained in the man page. This could replace the Android
version of selabel_hash_all_partial_matches(3), that could then be
converted into a local function (The Android team would need to approve).

The patch [3] "selinux-testsuite: Add test for restorecon" will test these
changes.

Patch 1/2 Changes:
V2 Change:
Restore using SELABEL_OPT_DIGEST
V3 Change:
Replace memcpy in get_digests_all_partial_matches() to overcome error
flagged by -D_FORTIFY_SOURCE= when building only libselinux.

Patch 2/2 Changes:
V2 Change
Keep restorecon(8) and setfiles(8) as they were for compatibility
 
[1] https://lore.kernel.org/selinux/20190311222442.49824-1-xunchang@google.com/
[2] https://lore.kernel.org/selinux/20190417180955.136942-1-xunchang@google.com/
[3] https://lore.kernel.org/selinux/20190603095609.21429-1-richard_c_haines@btinternet.com/

Richard Haines (2):
  libselinux: Save digest of all partial matches for directory
  setfiles: Update utilities for the new digest scheme

 libselinux/include/selinux/label.h            |   5 +
 libselinux/include/selinux/restorecon.h       |  17 +-
 .../selabel_get_digests_all_partial_matches.3 |  70 +++++
 libselinux/man/man3/selinux_restorecon.3      |  81 +++---
 .../man/man3/selinux_restorecon_xattr.3       |   8 +-
 libselinux/src/label.c                        |  15 +
 libselinux/src/label_file.c                   |  62 ++++
 libselinux/src/label_file.h                   |   4 +
 libselinux/src/label_internal.h               |   5 +
 libselinux/src/selinux_restorecon.c           | 271 ++++++++++++------
 libselinux/utils/.gitignore                   |   1 +
 .../selabel_get_digests_all_partial_matches.c | 170 +++++++++++
 policycoreutils/setfiles/restorecon.8         |  10 +-
 policycoreutils/setfiles/restorecon_xattr.8   |  20 +-
 policycoreutils/setfiles/restorecon_xattr.c   |   2 +-
 policycoreutils/setfiles/setfiles.8           |  10 +-
 16 files changed, 591 insertions(+), 160 deletions(-)
 create mode 100644 libselinux/man/man3/selabel_get_digests_all_partial_matches.3
 create mode 100644 libselinux/utils/selabel_get_digests_all_partial_matches.c

-- 
2.21.0