From 48de56d96b15a6879f653d8dad57f6862a3cbaa0 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Tue, 21 Jan 2020 11:18:22 -0500 Subject: [PATCH] libselinux: export flush_class_cache(), call it on policyload Rename flush_class_cache() to selinux_flush_class_cache(), export it for direct use by userspace policy enforcers, and call it on all policy load notifications rather than only when using selinux_check_access(). This ensures that policy reloads that change a userspace class or permission value will be reflected by subsequent string_to_security_class() or string_to_av_perm() calls. Signed-off-by: Stephen Smalley --- libselinux/include/selinux/selinux.h | 3 +++ libselinux/src/avc_internal.c | 2 ++ libselinux/src/checkAccess.c | 13 ------------- libselinux/src/selinux_internal.h | 3 +-- libselinux/src/stringrep.c | 4 +++- 5 files changed, 9 insertions(+), 16 deletions(-) diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h index fe46e681488d..7922d96b70c7 100644 --- a/libselinux/include/selinux/selinux.h +++ b/libselinux/include/selinux/selinux.h @@ -418,6 +418,9 @@ extern int security_av_string(security_class_t tclass, /* Display an access vector in a string representation. */ extern void print_access_vector(security_class_t tclass, access_vector_t av); +/* Flush the SELinux class cache, e.g. upon a policy reload. */ +extern void selinux_flush_class_cache(void); + /* Set the function used by matchpathcon_init when displaying errors about the file_contexts configuration. If not set, then this defaults to fprintf(stderr, fmt, ...). */ diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c index 49cecc96daee..568a3d928ac1 100644 --- a/libselinux/src/avc_internal.c +++ b/libselinux/src/avc_internal.c @@ -23,6 +23,7 @@ #include "callbacks.h" #include "selinux_netlink.h" #include "avc_internal.h" +#include "selinux_internal.h" #ifndef NETLINK_SELINUX #define NETLINK_SELINUX 7 @@ -207,6 +208,7 @@ static int avc_netlink_process(void *buf) avc_prefix, rc, errno); return rc; } + selinux_flush_class_cache(); rc = selinux_netlink_policyload(msg->seqno); if (rc < 0) return rc; diff --git a/libselinux/src/checkAccess.c b/libselinux/src/checkAccess.c index 16bfcfb63f85..7227ffe51eac 100644 --- a/libselinux/src/checkAccess.c +++ b/libselinux/src/checkAccess.c @@ -10,25 +10,12 @@ static pthread_once_t once = PTHREAD_ONCE_INIT; static int selinux_enabled; -static int avc_reset_callback(uint32_t event __attribute__((unused)), - security_id_t ssid __attribute__((unused)), - security_id_t tsid __attribute__((unused)), - security_class_t tclass __attribute__((unused)), - access_vector_t perms __attribute__((unused)), - access_vector_t *out_retained __attribute__((unused))) -{ - flush_class_cache(); - return 0; -} - static void avc_init_once(void) { selinux_enabled = is_selinux_enabled(); if (selinux_enabled == 1) { if (avc_open(NULL, 0)) return; - avc_add_callback(avc_reset_callback, AVC_CALLBACK_RESET, - 0, 0, 0, 0); } } diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h index 8b4bed2fd0d1..61b78aaa7c10 100644 --- a/libselinux/src/selinux_internal.h +++ b/libselinux/src/selinux_internal.h @@ -107,8 +107,7 @@ hidden_proto(selinux_trans_to_raw_context); hidden_proto(security_get_initial_context); hidden_proto(security_get_initial_context_raw); hidden_proto(selinux_reset_config); - -hidden void flush_class_cache(void); +hidden_proto(selinux_flush_class_cache); extern int require_seusers hidden; extern int selinux_page_size hidden; diff --git a/libselinux/src/stringrep.c b/libselinux/src/stringrep.c index 4db95398e138..29757b750878 100644 --- a/libselinux/src/stringrep.c +++ b/libselinux/src/stringrep.c @@ -158,7 +158,7 @@ err1: return NULL; } -hidden void flush_class_cache(void) +void selinux_flush_class_cache(void) { struct discover_class_node *cur = discover_class_cache, *prev = NULL; size_t i; @@ -180,6 +180,8 @@ hidden void flush_class_cache(void) discover_class_cache = NULL; } +hidden_def(selinux_flush_class_cache) + security_class_t string_to_security_class(const char *s) { struct discover_class_node *node; -- 2.25.1