From ecabcf8b6edcc856ec2fd5bd43fc675a8fe04731 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 23 Oct 2014 19:41:27 +0200 Subject: [PATCH] selinux: clean up selinux label function naming --- src/core/namespace.c | 4 +- src/core/socket.c | 6 +- src/shared/dev-setup.c | 4 +- src/shared/fileio-label.c | 12 ++-- src/shared/selinux-util.c | 126 +++++++++++++++++++--------------- src/shared/selinux-util.h | 20 +++--- src/shared/socket-label.c | 4 +- src/tmpfiles/tmpfiles.c | 28 ++++---- src/udev/udev-node.c | 11 +-- src/update-done/update-done.c | 4 +- 10 files changed, 117 insertions(+), 102 deletions(-) diff --git a/src/core/namespace.c b/src/core/namespace.c index 6dd7a4f25..4bc288de1 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -225,9 +225,9 @@ static int mount_dev(BindMount *m) { goto fail; } - mac_selinux_context_set(d, st.st_mode); + mac_selinux_create_file_prepare(d, st.st_mode); r = mknod(dn, st.st_mode, st.st_rdev); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); if (r < 0) { r = -errno; diff --git a/src/core/socket.c b/src/core/socket.c index e9cf7b3e9..dc16af5e3 100644 --- a/src/core/socket.c +++ b/src/core/socket.c @@ -967,7 +967,7 @@ static int fifo_address_create( mkdir_parents_label(path, directory_mode); - r = mac_selinux_context_set(path, S_IFIFO); + r = mac_selinux_create_file_prepare(path, S_IFIFO); if (r < 0) goto fail; @@ -990,7 +990,7 @@ static int fifo_address_create( goto fail; } - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); if (fstat(fd, &st) < 0) { r = -errno; @@ -1010,7 +1010,7 @@ static int fifo_address_create( return 0; fail: - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); safe_close(fd); return r; diff --git a/src/shared/dev-setup.c b/src/shared/dev-setup.c index 96934a9fa..ae1c3d9d4 100644 --- a/src/shared/dev-setup.c +++ b/src/shared/dev-setup.c @@ -38,14 +38,14 @@ static int symlink_and_label(const char *old_path, const char *new_path) { assert(old_path); assert(new_path); - r = mac_selinux_context_set(new_path, S_IFLNK); + r = mac_selinux_create_file_prepare(new_path, S_IFLNK); if (r < 0) return r; if (symlink(old_path, new_path) < 0) r = -errno; - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); return r; } diff --git a/src/shared/fileio-label.c b/src/shared/fileio-label.c index b117c32cf..294c9e6ba 100644 --- a/src/shared/fileio-label.c +++ b/src/shared/fileio-label.c @@ -30,13 +30,13 @@ int write_string_file_atomic_label(const char *fn, const char *line) { int r; - r = mac_selinux_context_set(fn, S_IFREG); + r = mac_selinux_create_file_prepare(fn, S_IFREG); if (r < 0) return r; r = write_string_file_atomic(fn, line); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); return r; } @@ -44,13 +44,13 @@ int write_string_file_atomic_label(const char *fn, const char *line) { int write_env_file_label(const char *fname, char **l) { int r; - r = mac_selinux_context_set(fname, S_IFREG); + r = mac_selinux_create_file_prepare(fname, S_IFREG); if (r < 0) return r; r = write_env_file(fname, l); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); return r; } @@ -59,13 +59,13 @@ int fopen_temporary_label(const char *target, const char *path, FILE **f, char **temp_path) { int r; - r = mac_selinux_context_set(target, S_IFREG); + r = mac_selinux_create_file_prepare(target, S_IFREG); if (r < 0) return r; r = fopen_temporary(path, f, temp_path); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); return r; } diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index 76d3916ea..0d8c6c2f1 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -109,11 +109,21 @@ int mac_selinux_init(const char *prefix) { return r; } +void mac_selinux_finish(void) { + +#ifdef HAVE_SELINUX + if (!label_hnd) + return; + + selabel_close(label_hnd); +#endif +} + int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) { - int r = 0; #ifdef HAVE_SELINUX struct stat st; + int r; assert(path); @@ -148,22 +158,31 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) { if (ignore_erofs && errno == EROFS) return 0; - log_enforcing("Unable to fix SELinux label of %s: %m", path); - r = security_getenforce() == 1 ? -errno : 0; + log_enforcing("Unable to fix SELinux security context of %s: %m", path); + if (security_getenforce() == 1) + return -errno; } #endif - return r; + return 0; } -void mac_selinux_finish(void) { +int mac_selinux_apply(const char *path, const char *label) { #ifdef HAVE_SELINUX - if (!label_hnd) - return; + assert(path); + assert(label); - selabel_close(label_hnd); + if (!mac_selinux_use()) + return 0; + + if (setfilecon(path, (security_context_t) label) < 0) { + log_enforcing("Failed to set SELinux security context %s on path %s: %m", label, path); + if (security_getenforce() == 1) + return -errno; + } #endif + return 0; } int mac_selinux_get_create_label_from_exe(const char *exe, char **label) { @@ -279,12 +298,24 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, char **label return r; } -int mac_selinux_context_set(const char *path, mode_t mode) { +void mac_selinux_free(char *label) { + +#ifdef HAVE_SELINUX + if (!mac_selinux_use()) + return; + + freecon((security_context_t) label); +#endif +} + +int mac_selinux_create_file_prepare(const char *path, mode_t mode) { int r = 0; #ifdef HAVE_SELINUX _cleanup_security_context_free_ security_context_t filecon = NULL; + assert(path); + if (!label_hnd) return 0; @@ -294,7 +325,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) { else if (r == 0) { r = setfscreatecon(filecon); if (r < 0) { - log_enforcing("Failed to set SELinux file context on %s: %m", path); + log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path); r = -errno; } } @@ -306,24 +337,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) { return r; } -int mac_selinux_socket_set(const char *label) { - -#ifdef HAVE_SELINUX - if (!mac_selinux_use()) - return 0; - - if (setsockcreatecon((security_context_t) label) < 0) { - log_enforcing("Failed to set SELinux context (%s) on socket: %m", label); - - if (security_getenforce() == 1) - return -errno; - } -#endif - - return 0; -} - -void mac_selinux_context_clear(void) { +void mac_selinux_create_file_clear(void) { #ifdef HAVE_SELINUX PROTECT_ERRNO; @@ -335,37 +349,49 @@ void mac_selinux_context_clear(void) { #endif } -void mac_selinux_socket_clear(void) { +int mac_selinux_create_socket_prepare(const char *label) { #ifdef HAVE_SELINUX - PROTECT_ERRNO; - if (!mac_selinux_use()) - return; + return 0; - setsockcreatecon(NULL); + assert(label); + + if (setsockcreatecon((security_context_t) label) < 0) { + log_enforcing("Failed to set SELinux security context %s for sockets: %m", label); + + if (security_getenforce() == 1) + return -errno; + } #endif + + return 0; } -void mac_selinux_free(const char *label) { +void mac_selinux_create_socket_clear(void) { #ifdef HAVE_SELINUX + PROTECT_ERRNO; + if (!mac_selinux_use()) return; - freecon((security_context_t) label); + setsockcreatecon(NULL); #endif } int mac_selinux_mkdir(const char *path, mode_t mode) { - int r = 0; -#ifdef HAVE_SELINUX /* Creates a directory and labels it according to the SELinux policy */ + +#ifdef HAVE_SELINUX _cleanup_security_context_free_ security_context_t fcon = NULL; + int r; + + assert(path); if (!label_hnd) - return 0; + goto skipped; if (path_is_absolute(path)) r = selabel_lookup_raw(label_hnd, &fcon, path, S_IFDIR); @@ -383,7 +409,7 @@ int mac_selinux_mkdir(const char *path, mode_t mode) { r = setfscreatecon(fcon); if (r < 0 && errno != ENOENT) { - log_enforcing("Failed to set security context %s for %s: %m", fcon, path); + log_enforcing("Failed to set SELinux security context %s for %s: %m", fcon, path); if (security_getenforce() == 1) { r = -errno; @@ -397,9 +423,11 @@ int mac_selinux_mkdir(const char *path, mode_t mode) { finish: setfscreatecon(NULL); -#endif - return r; + +skipped: +#endif + return mkdir(path, mode) < 0 ? -errno : 0; } int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { @@ -416,7 +444,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { assert(addr); assert(addrlen >= sizeof(sa_family_t)); - if (!mac_selinux_use() || !label_hnd) + if (!label_hnd) goto skipped; /* Filter out non-local sockets */ @@ -450,7 +478,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { r = setfscreatecon(fcon); if (r < 0 && errno != ENOENT) { - log_enforcing("Failed to set security context %s for %s: %m", fcon, path); + log_enforcing("Failed to set SELinux security context %s for %s: %m", fcon, path); if (security_getenforce() == 1) { r = -errno; @@ -470,15 +498,3 @@ skipped: #endif return bind(fd, addr, addrlen) < 0 ? -errno : 0; } - -int mac_selinux_apply(const char *path, const char *label) { - int r = 0; - -#ifdef HAVE_SELINUX - if (!mac_selinux_use()) - return 0; - - r = setfilecon(path, (char *)label); -#endif - return r; -} diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h index 80546986d..bce9fd5d4 100644 --- a/src/shared/selinux-util.h +++ b/src/shared/selinux-util.h @@ -32,20 +32,18 @@ int mac_selinux_init(const char *prefix); void mac_selinux_finish(void); int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs); - -int mac_selinux_socket_set(const char *label); -void mac_selinux_socket_clear(void); - -int mac_selinux_context_set(const char *path, mode_t mode); -void mac_selinux_context_clear(void); - -int mac_selinux_mkdir(const char *path, mode_t mode); +int mac_selinux_apply(const char *path, const char *label); int mac_selinux_get_create_label_from_exe(const char *exe, char **label); int mac_selinux_get_our_label(char **label); int mac_selinux_get_child_mls_label(int socket_fd, const char *exec, char **label); -void mac_selinux_free(const char *label); +void mac_selinux_free(char *label); -int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen); +int mac_selinux_create_file_prepare(const char *path, mode_t mode); +void mac_selinux_create_file_clear(void); -int mac_selinux_apply(const char *path, const char *label); +int mac_selinux_create_socket_prepare(const char *label); +void mac_selinux_create_socket_clear(void); + +int mac_selinux_mkdir(const char *path, mode_t mode); +int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen); diff --git a/src/shared/socket-label.c b/src/shared/socket-label.c index 6f9aeeea5..47d9488d5 100644 --- a/src/shared/socket-label.c +++ b/src/shared/socket-label.c @@ -64,7 +64,7 @@ int socket_address_listen( return -EAFNOSUPPORT; if (label) { - r = mac_selinux_socket_set(label); + r = mac_selinux_create_socket_prepare(label); if (r < 0) return r; } @@ -73,7 +73,7 @@ int socket_address_listen( r = fd < 0 ? -errno : 0; if (label) - mac_selinux_socket_clear(); + mac_selinux_create_socket_clear(); if (r < 0) return r; diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index 28c395bb0..1e4675f87 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -509,9 +509,9 @@ static int write_one_file(Item *i, const char *path) { i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0; RUN_WITH_UMASK(0000) { - mac_selinux_context_set(path, S_IFREG); + mac_selinux_create_file_prepare(path, S_IFREG); fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } if (fd < 0) { @@ -743,9 +743,9 @@ static int create_item(Item *i) { case CREATE_FIFO: RUN_WITH_UMASK(0000) { - mac_selinux_context_set(i->path, S_IFIFO); + mac_selinux_create_file_prepare(i->path, S_IFIFO); r = mkfifo(i->path, i->mode); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { @@ -764,9 +764,9 @@ static int create_item(Item *i) { if (i->force) { RUN_WITH_UMASK(0000) { - mac_selinux_context_set(i->path, S_IFIFO); + mac_selinux_create_file_prepare(i->path, S_IFIFO); r = mkfifo_atomic(i->path, i->mode); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { @@ -788,9 +788,9 @@ static int create_item(Item *i) { case CREATE_SYMLINK: - mac_selinux_context_set(i->path, S_IFLNK); + mac_selinux_create_file_prepare(i->path, S_IFLNK); r = symlink(i->argument, i->path); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); if (r < 0) { _cleanup_free_ char *x = NULL; @@ -804,9 +804,9 @@ static int create_item(Item *i) { if (r < 0 || !streq(i->argument, x)) { if (i->force) { - mac_selinux_context_set(i->path, S_IFLNK); + mac_selinux_create_file_prepare(i->path, S_IFLNK); r = symlink_atomic(i->argument, i->path); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); if (r < 0) { log_error("symlink(%s, %s) failed: %s", i->argument, i->path, strerror(-r)); @@ -838,9 +838,9 @@ static int create_item(Item *i) { file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR; RUN_WITH_UMASK(0000) { - mac_selinux_context_set(i->path, file_type); + mac_selinux_create_file_prepare(i->path, file_type); r = mknod(i->path, i->mode | file_type, i->major_minor); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { @@ -865,9 +865,9 @@ static int create_item(Item *i) { if (i->force) { RUN_WITH_UMASK(0000) { - mac_selinux_context_set(i->path, file_type); + mac_selinux_create_file_prepare(i->path, file_type); r = mknod_atomic(i->path, i->mode | file_type, i->major_minor); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c index 8d5bada5a..4ac6f7149 100644 --- a/src/udev/udev-node.c +++ b/src/udev/udev-node.c @@ -88,11 +88,11 @@ static int node_symlink(struct udev_device *dev, const char *node, const char *s err = mkdir_parents_label(slink, 0755); if (err != 0 && err != -ENOENT) break; - mac_selinux_context_set(slink, S_IFLNK); + mac_selinux_create_file_prepare(slink, S_IFLNK); err = symlink(target, slink); if (err != 0) err = -errno; - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } while (err == -ENOENT); if (err == 0) goto exit; @@ -105,11 +105,11 @@ static int node_symlink(struct udev_device *dev, const char *node, const char *s err = mkdir_parents_label(slink_tmp, 0755); if (err != 0 && err != -ENOENT) break; - mac_selinux_context_set(slink_tmp, S_IFLNK); + mac_selinux_create_file_prepare(slink_tmp, S_IFLNK); err = symlink(target, slink_tmp); if (err != 0) err = -errno; - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); } while (err == -ENOENT); if (err != 0) { log_error("symlink '%s' '%s' failed: %m", target, slink_tmp); @@ -302,7 +302,8 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, if (streq(name, "selinux")) { selinux = true; - if (mac_selinux_apply(devnode, label) < 0) + r = mac_selinux_apply(devnode, label); + if (r < 0) log_error("SECLABEL: failed to set SELinux label '%s': %s", label, strerror(-r)); else log_debug("SECLABEL: set SELinux label '%s'", label); diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c index d48e4f76d..1437c30d1 100644 --- a/src/update-done/update-done.c +++ b/src/update-done/update-done.c @@ -61,7 +61,7 @@ static int apply_timestamp(const char *path, struct timespec *ts) { /* The timestamp file doesn't exist yet? Then let's create it. */ - r = mac_selinux_context_set(path, S_IFREG); + r = mac_selinux_create_file_prepare(path, S_IFREG); if (r < 0) { log_error("Failed to set SELinux context for %s: %s", path, strerror(-r)); @@ -69,7 +69,7 @@ static int apply_timestamp(const char *path, struct timespec *ts) { } fd = open(path, O_CREAT|O_EXCL|O_WRONLY|O_TRUNC|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0644); - mac_selinux_context_clear(); + mac_selinux_create_file_clear(); if (fd < 0) { -- 2.30.2