70de4204ca
* libsemanage: do not set soname needlessly * libsemanage: remove PYTHONLIBDIR and ruby equivalent * do boolean name substitution * Fix segfault for building standard policies.
202 lines
7.1 KiB
Diff
202 lines
7.1 KiB
Diff
diff --git a/libsemanage/src/conf-parse.y b/libsemanage/src/conf-parse.y
|
|
index bbdac1d..80d08ec 100644
|
|
--- a/libsemanage/src/conf-parse.y
|
|
+++ b/libsemanage/src/conf-parse.y
|
|
@@ -58,7 +58,7 @@ static int parse_errors;
|
|
}
|
|
|
|
%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE SAVE_PREVIOUS SAVE_LINKED
|
|
-%token LOAD_POLICY_START SETFILES_START DISABLE_GENHOMEDIRCON HANDLE_UNKNOWN USEPASSWD IGNOREDIRS
|
|
+%token LOAD_POLICY_START SETFILES_START SEFCONTEXT_COMPILE_START DISABLE_GENHOMEDIRCON HANDLE_UNKNOWN USEPASSWD IGNOREDIRS
|
|
%token BZIP_BLOCKSIZE BZIP_SMALL
|
|
%token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START BLOCK_END
|
|
%token PROG_PATH PROG_ARGS
|
|
@@ -230,6 +230,14 @@ command_start:
|
|
YYABORT;
|
|
}
|
|
}
|
|
+ | SEFCONTEXT_COMPILE_START {
|
|
+ semanage_conf_external_prog_destroy(current_conf->sefcontext_compile);
|
|
+ current_conf->sefcontext_compile = NULL;
|
|
+ if (new_external_prog(¤t_conf->sefcontext_compile) == -1) {
|
|
+ parse_errors++;
|
|
+ YYABORT;
|
|
+ }
|
|
+ }
|
|
;
|
|
|
|
verify_block: verify_start external_opts BLOCK_END {
|
|
@@ -308,6 +316,20 @@ static int semanage_conf_init(semanage_conf_t * conf)
|
|
return -1;
|
|
}
|
|
|
|
+ if ((conf->sefcontext_compile =
|
|
+ calloc(1, sizeof(*(current_conf->sefcontext_compile)))) == NULL) {
|
|
+ return -1;
|
|
+ }
|
|
+ if (access("/sbin/sefcontext_compile", X_OK) == 0) {
|
|
+ conf->sefcontext_compile->path = strdup("/sbin/sefcontext_compile");
|
|
+ } else {
|
|
+ conf->sefcontext_compile->path = strdup("/usr/sbin/sefcontext_compile");
|
|
+ }
|
|
+ if ((conf->sefcontext_compile->path == NULL) ||
|
|
+ (conf->sefcontext_compile->args = strdup("$@")) == NULL) {
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
return 0;
|
|
}
|
|
|
|
@@ -363,6 +385,7 @@ void semanage_conf_destroy(semanage_conf_t * conf)
|
|
free(conf->ignoredirs);
|
|
semanage_conf_external_prog_destroy(conf->load_policy);
|
|
semanage_conf_external_prog_destroy(conf->setfiles);
|
|
+ semanage_conf_external_prog_destroy(conf->sefcontext_compile);
|
|
semanage_conf_external_prog_destroy(conf->mod_prog);
|
|
semanage_conf_external_prog_destroy(conf->linked_prog);
|
|
semanage_conf_external_prog_destroy(conf->kernel_prog);
|
|
diff --git a/libsemanage/src/conf-scan.l b/libsemanage/src/conf-scan.l
|
|
index 7ef4154..41ba044 100644
|
|
--- a/libsemanage/src/conf-scan.l
|
|
+++ b/libsemanage/src/conf-scan.l
|
|
@@ -53,6 +53,7 @@ bzip-blocksize return BZIP_BLOCKSIZE;
|
|
bzip-small return BZIP_SMALL;
|
|
"[load_policy]" return LOAD_POLICY_START;
|
|
"[setfiles]" return SETFILES_START;
|
|
+"[sefcontext_compile]" return SEFCONTEXT_COMPILE_START;
|
|
"[verify module]" return VERIFY_MOD_START;
|
|
"[verify linked]" return VERIFY_LINKED_START;
|
|
"[verify kernel]" return VERIFY_KERNEL_START;
|
|
diff --git a/libsemanage/src/handle.c b/libsemanage/src/handle.c
|
|
index 7fcd2b4..6aa9057 100644
|
|
--- a/libsemanage/src/handle.c
|
|
+++ b/libsemanage/src/handle.c
|
|
@@ -52,6 +52,26 @@ static char *private_usersconf_path = NULL;
|
|
static char *private_netfilter_context_path = NULL;
|
|
static char *private_policy_root = NULL;
|
|
|
|
+static char *get_policy_path(void) {
|
|
+ char *dup_path = NULL;
|
|
+ int max = security_policyvers();
|
|
+ if (max < 0)
|
|
+ max = sepol_policy_kern_vers_max();
|
|
+
|
|
+ char *policy_path = selinux_binary_policy_path_min_max(0, &max);
|
|
+ if (policy_path) {
|
|
+ dup_path = strdup(policy_path);
|
|
+ free(policy_path);
|
|
+ } else {
|
|
+ /* No Policy installed so just do max */
|
|
+ int ret = asprintf(&policy_path, "%s.%d", selinux_binary_policy_path(), sepol_policy_kern_vers_max());
|
|
+ if (ret > 0)
|
|
+ dup_path = strdup(policy_path);
|
|
+ free(policy_path);
|
|
+ }
|
|
+ return dup_path;
|
|
+}
|
|
+
|
|
void semanage_free_root() {
|
|
free(private_selinux_path); private_selinux_path = NULL;
|
|
free(private_semanage_conf_path); private_semanage_conf_path = NULL;
|
|
@@ -91,9 +111,15 @@ int semanage_set_root(const char *path) {
|
|
goto error;
|
|
}
|
|
|
|
- if ( asprintf(&private_binary_policy_path, "%s/%s", path, selinux_binary_policy_path()) < 0 ) {
|
|
+ char *policy_path = get_policy_path();
|
|
+ if (! policy_path)
|
|
+ goto error;
|
|
+
|
|
+ if ( asprintf(&private_binary_policy_path, "%s/%s", path, policy_path) < 0 ) {
|
|
+ free(policy_path);
|
|
goto error;
|
|
}
|
|
+ free(policy_path);
|
|
|
|
if ( asprintf(&private_usersconf_path, "%s/%s", path, selinux_usersconf_path()) < 0 ) {
|
|
goto error;
|
|
@@ -147,7 +173,9 @@ const char *semanage_binary_policy_path() {
|
|
// printf("private_binary_policy_path %s\n", private_binary_policy_path);
|
|
if (private_binary_policy_path)
|
|
return private_binary_policy_path;
|
|
- return selinux_binary_policy_path();
|
|
+
|
|
+ private_binary_policy_path = get_policy_path();
|
|
+ return private_binary_policy_path;
|
|
}
|
|
|
|
const char *semanage_usersconf_path() {
|
|
diff --git a/libsemanage/src/semanage_conf.h b/libsemanage/src/semanage_conf.h
|
|
index 95f8ec3..9b7852c 100644
|
|
--- a/libsemanage/src/semanage_conf.h
|
|
+++ b/libsemanage/src/semanage_conf.h
|
|
@@ -46,6 +46,7 @@ typedef struct semanage_conf {
|
|
char *ignoredirs; /* ";" separated of list for genhomedircon to ignore */
|
|
struct external_prog *load_policy;
|
|
struct external_prog *setfiles;
|
|
+ struct external_prog *sefcontext_compile;
|
|
struct external_prog *mod_prog, *linked_prog, *kernel_prog;
|
|
} semanage_conf_t;
|
|
|
|
diff --git a/libsemanage/src/semanage_store.c b/libsemanage/src/semanage_store.c
|
|
index cd7ce68..2fab63e 100644
|
|
--- a/libsemanage/src/semanage_store.c
|
|
+++ b/libsemanage/src/semanage_store.c
|
|
@@ -1100,6 +1100,17 @@ int semanage_split_fc(semanage_handle_t * sh)
|
|
|
|
}
|
|
|
|
+static int sefcontext_compile(semanage_handle_t * sh, const char *path) {
|
|
+
|
|
+ int r;
|
|
+ if ((r = semanage_exec_prog(sh, sh->conf->sefcontext_compile, path, "")) != 0) {
|
|
+ ERR(sh, "sefcontext_compile returned error code %d. Compiling %s", r, path);
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
/* Actually load the contents of the current active directory into the
|
|
* kernel. Return 0 on success, -3 on error. */
|
|
static int semanage_install_active(semanage_handle_t * sh)
|
|
@@ -1145,8 +1156,7 @@ static int semanage_install_active(semanage_handle_t * sh)
|
|
if (asprintf(&storepath, "%s%s", semanage_selinux_path(), sh->conf->store_path) < 0)
|
|
return retval;
|
|
|
|
- snprintf(store_pol, PATH_MAX, "%s%s.%d", storepath,
|
|
- running_policy, sh->conf->policyvers);
|
|
+ snprintf(store_pol, PATH_MAX, "%s%s", storepath, running_policy);
|
|
if (semanage_copy_file(active_kernel, store_pol, sh->conf->file_mode) ==
|
|
-1) {
|
|
ERR(sh, "Could not copy %s to %s.", active_kernel, store_pol);
|
|
@@ -1233,6 +1243,16 @@ static int semanage_install_active(semanage_handle_t * sh)
|
|
goto cleanup;
|
|
}
|
|
|
|
+ if (sefcontext_compile(sh, store_fc) != 0) {
|
|
+ goto cleanup;
|
|
+ }
|
|
+ if (sefcontext_compile(sh, store_fc_loc) != 0) {
|
|
+ goto cleanup;
|
|
+ }
|
|
+ if (sefcontext_compile(sh, store_fc_hd) != 0) {
|
|
+ goto cleanup;
|
|
+ }
|
|
+
|
|
retval = 0;
|
|
cleanup:
|
|
free(storepath);
|
|
@@ -1371,6 +1391,11 @@ int semanage_install_sandbox(semanage_handle_t * sh)
|
|
goto cleanup;
|
|
}
|
|
|
|
+ if (sh->conf->sefcontext_compile == NULL) {
|
|
+ ERR(sh, "No sefcontext_compile program specified in configuration file.");
|
|
+ goto cleanup;
|
|
+ }
|
|
+
|
|
if ((commit_num = semanage_commit_sandbox(sh)) < 0) {
|
|
retval = commit_num;
|
|
goto cleanup;
|