From 6baa7db00812437bbc87e73faa1a11b6cf631958 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 23 Oct 2014 17:34:30 +0200 Subject: [PATCH] mac: also rename use_{smack,selinux,apparmor}() calls so that they share the new mac_{smack,selinux,apparmor}_xyz() convention --- src/core/condition.c | 8 ++++---- src/core/execute.c | 4 ++-- src/core/mount-setup.c | 6 +++--- src/core/selinux-access.c | 4 ++-- src/core/selinux-setup.c | 2 +- src/journal/journald-native.c | 2 +- src/journal/journald-server.c | 2 +- src/journal/journald-stream.c | 2 +- src/journal/journald-syslog.c | 2 +- src/login/logind-user.c | 2 +- src/shared/apparmor-util.c | 11 +++++------ src/shared/apparmor-util.h | 2 +- src/shared/label.c | 4 ++-- src/shared/mkdir-label.c | 4 ++-- src/shared/selinux-util.c | 34 +++++++++++++++++----------------- src/shared/selinux-util.h | 7 ++++--- src/shared/smack-util.c | 18 +++++++++--------- src/shared/smack-util.h | 2 +- 18 files changed, 58 insertions(+), 58 deletions(-) diff --git a/src/core/condition.c b/src/core/condition.c index 353e0c97f..ec78169fc 100644 --- a/src/core/condition.c +++ b/src/core/condition.c @@ -45,13 +45,13 @@ static bool condition_test_security(Condition *c) { assert(c->type == CONDITION_SECURITY); if (streq(c->parameter, "selinux")) - return use_selinux() == !c->negate; + return mac_selinux_use() == !c->negate; + if (streq(c->parameter, "smack")) + return mac_smack_use() == !c->negate; if (streq(c->parameter, "apparmor")) - return use_apparmor() == !c->negate; + return mac_apparmor_use() == !c->negate; if (streq(c->parameter, "ima")) return use_ima() == !c->negate; - if (streq(c->parameter, "smack")) - return use_smack() == !c->negate; return c->negate; } diff --git a/src/core/execute.c b/src/core/execute.c index caff2c6b5..c41aec222 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -1669,7 +1669,7 @@ static int exec_child(ExecCommand *command, #endif #ifdef HAVE_SELINUX - if (use_selinux()) { + if (mac_selinux_use()) { if (context->selinux_context) { err = setexeccon(context->selinux_context); if (err < 0 && !context->selinux_context_ignore) { @@ -1697,7 +1697,7 @@ static int exec_child(ExecCommand *command, #endif #ifdef HAVE_APPARMOR - if (context->apparmor_profile && use_apparmor()) { + if (context->apparmor_profile && mac_apparmor_use()) { err = aa_change_onexec(context->apparmor_profile); if (err < 0 && !context->apparmor_profile_ignore) { *error = EXIT_APPARMOR_PROFILE; diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index 8e9121782..cda25ede1 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -82,9 +82,9 @@ static const MountPoint mount_table[] = { NULL, MNT_NONE }, #ifdef HAVE_SMACK { "smackfs", "/sys/fs/smackfs", "smackfs", "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, - use_smack, MNT_FATAL }, + mac_smack_use, MNT_FATAL }, { "tmpfs", "/dev/shm", "tmpfs", "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME, - use_smack, MNT_FATAL }, + mac_smack_use, MNT_FATAL }, #endif { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, NULL, MNT_FATAL|MNT_IN_CONTAINER }, @@ -92,7 +92,7 @@ static const MountPoint mount_table[] = { NULL, MNT_IN_CONTAINER }, #ifdef HAVE_SMACK { "tmpfs", "/run", "tmpfs", "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME, - use_smack, MNT_FATAL }, + mac_smack_use, MNT_FATAL }, #endif { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, NULL, MNT_FATAL|MNT_IN_CONTAINER }, diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c index 184f202c1..08ea6efb7 100644 --- a/src/core/selinux-access.c +++ b/src/core/selinux-access.c @@ -142,7 +142,7 @@ static int selinux_access_init(sd_bus_error *error) { if (initialized) return 0; - if (!use_selinux()) + if (!mac_selinux_use()) return 0; r = access_init(); @@ -186,7 +186,7 @@ int selinux_generic_access_check( assert(permission); assert(error); - if (!use_selinux()) + if (!mac_selinux_use()) return 0; r = selinux_access_init(error); diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c index 8be97fc41..4e615c2b6 100644 --- a/src/core/selinux-setup.c +++ b/src/core/selinux-setup.c @@ -84,7 +84,7 @@ int selinux_setup(bool *loaded_policy) { char timespan[FORMAT_TIMESPAN_MAX]; char *label; - retest_selinux(); + mac_selinux_retest(); /* Transition to the new context */ r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label); diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c index ac2d0ba14..a6352022d 100644 --- a/src/journal/journald-native.c +++ b/src/journal/journald-native.c @@ -417,7 +417,7 @@ int server_open_native_socket(Server*s) { } #ifdef HAVE_SELINUX - if (use_selinux()) { + if (mac_selinux_use()) { one = 1; r = setsockopt(s->native_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)); if (r < 0) diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index 991f4f2a3..9709889e4 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -680,7 +680,7 @@ static void dispatch_message_real( } #ifdef HAVE_SELINUX - if (use_selinux()) { + if (mac_selinux_use()) { if (label) { x = alloca(strlen("_SELINUX_CONTEXT=") + label_len + 1); diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c index 8a983d84d..76580f826 100644 --- a/src/journal/journald-stream.c +++ b/src/journal/journald-stream.c @@ -395,7 +395,7 @@ static int stdout_stream_new(sd_event_source *es, int listen_fd, uint32_t revent } #ifdef HAVE_SELINUX - if (use_selinux()) { + if (mac_selinux_use()) { if (getpeercon(fd, &stream->security_context) < 0 && errno != ENOPROTOOPT) log_error("Failed to determine peer security context: %m"); } diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c index 656dc72bb..79c07fffa 100644 --- a/src/journal/journald-syslog.c +++ b/src/journal/journald-syslog.c @@ -457,7 +457,7 @@ int server_open_syslog_socket(Server *s) { } #ifdef HAVE_SELINUX - if (use_selinux()) { + if (mac_selinux_use()) { one = 1; r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)); if (r < 0) diff --git a/src/login/logind-user.c b/src/login/logind-user.c index 3847496c1..1205b48ab 100644 --- a/src/login/logind-user.c +++ b/src/login/logind-user.c @@ -326,7 +326,7 @@ static int user_mkdir_runtime_path(User *u) { mkdir(p, 0700); - if (use_smack()) + if (mac_smack_use()) r = asprintf(&t, "mode=0700,smackfsroot=*,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size); else r = asprintf(&t, "mode=0700,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size); diff --git a/src/shared/apparmor-util.c b/src/shared/apparmor-util.c index 2b85da1e4..c14843da4 100644 --- a/src/shared/apparmor-util.c +++ b/src/shared/apparmor-util.c @@ -25,17 +25,16 @@ #include "fileio.h" #include "apparmor-util.h" -static int use_apparmor_cached = -1; +bool mac_apparmor_use(void) { + static int cached_use = -1; -bool use_apparmor(void) { - - if (use_apparmor_cached < 0) { + if (cached_use < 0) { _cleanup_free_ char *p = NULL; - use_apparmor_cached = + cached_use = read_one_line_file("/sys/module/apparmor/parameters/enabled", &p) >= 0 && parse_boolean(p) > 0; } - return use_apparmor_cached; + return cached_use; } diff --git a/src/shared/apparmor-util.h b/src/shared/apparmor-util.h index 4b056a1aa..a3d1b3b06 100644 --- a/src/shared/apparmor-util.h +++ b/src/shared/apparmor-util.h @@ -23,4 +23,4 @@ #include -bool use_apparmor(void); +bool mac_apparmor_use(void); diff --git a/src/shared/label.c b/src/shared/label.c index bee963573..fe7fd8381 100644 --- a/src/shared/label.c +++ b/src/shared/label.c @@ -25,13 +25,13 @@ int label_fix(const char *path, bool ignore_enoent, bool ignore_erofs) { int r = 0; - if (use_selinux()) { + if (mac_selinux_use()) { r = mac_selinux_fix(path, ignore_enoent, ignore_erofs); if (r < 0) return r; } - if (use_smack()) { + if (mac_smack_use()) { r = mac_smack_relabel_in_dev(path); if (r < 0) return r; diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c index 89af39281..2b9cb161c 100644 --- a/src/shared/mkdir-label.c +++ b/src/shared/mkdir-label.c @@ -35,13 +35,13 @@ static int label_mkdir(const char *path, mode_t mode) { int r; - if (use_selinux()) { + if (mac_selinux_use()) { r = mac_selinux_mkdir(path, mode); if (r < 0) return r; } - if (use_smack()) { + if (mac_smack_use()) { r = mkdir(path, mode); if (r < 0 && errno != EEXIST) return -errno; diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index a277dad35..5a5bfbdb0 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -40,24 +40,24 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free); #define _cleanup_security_context_free_ _cleanup_(freeconp) #define _cleanup_context_free_ _cleanup_(context_freep) -static int use_selinux_cached = -1; +static int cached_use = -1; static struct selabel_handle *label_hnd = NULL; #endif -bool use_selinux(void) { +bool mac_selinux_use(void) { #ifdef HAVE_SELINUX - if (use_selinux_cached < 0) - use_selinux_cached = is_selinux_enabled() > 0; + if (cached_use < 0) + cached_use = is_selinux_enabled() > 0; - return use_selinux_cached; + return cached_use; #else return false; #endif } -void retest_selinux(void) { +void mac_selinux_retest(void) { #ifdef HAVE_SELINUX - use_selinux_cached = -1; + cached_use = -1; #endif } @@ -68,7 +68,7 @@ int mac_selinux_init(const char *prefix) { usec_t before_timestamp, after_timestamp; struct mallinfo before_mallinfo, after_mallinfo; - if (!use_selinux()) + if (!mac_selinux_use()) return 0; if (label_hnd) @@ -156,7 +156,7 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) { void mac_selinux_finish(void) { #ifdef HAVE_SELINUX - if (!use_selinux()) + if (!mac_selinux_use()) return; if (label_hnd) @@ -172,7 +172,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) { security_context_t mycon = NULL, fcon = NULL; security_class_t sclass; - if (!use_selinux()) { + if (!mac_selinux_use()) { *label = NULL; return 0; } @@ -315,7 +315,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) { #ifdef HAVE_SELINUX security_context_t filecon = NULL; - if (!use_selinux() || !label_hnd) + if (!mac_selinux_use() || !label_hnd) return 0; r = selabel_lookup_raw(label_hnd, &filecon, path, mode); @@ -341,7 +341,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) { int mac_selinux_socket_set(const char *label) { #ifdef HAVE_SELINUX - if (!use_selinux()) + if (!mac_selinux_use()) return 0; if (setsockcreatecon((security_context_t) label) < 0) { @@ -361,7 +361,7 @@ void mac_selinux_context_clear(void) { #ifdef HAVE_SELINUX PROTECT_ERRNO; - if (!use_selinux()) + if (!mac_selinux_use()) return; setfscreatecon(NULL); @@ -373,7 +373,7 @@ void mac_selinux_socket_clear(void) { #ifdef HAVE_SELINUX PROTECT_ERRNO; - if (!use_selinux()) + if (!mac_selinux_use()) return; setsockcreatecon(NULL); @@ -383,7 +383,7 @@ void mac_selinux_socket_clear(void) { void mac_selinux_free(const char *label) { #ifdef HAVE_SELINUX - if (!use_selinux()) + if (!mac_selinux_use()) return; freecon((security_context_t) label); @@ -450,7 +450,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { assert(addr); assert(addrlen >= sizeof(sa_family_t)); - if (!use_selinux() || !label_hnd) + if (!mac_selinux_use() || !label_hnd) goto skipped; /* Filter out non-local sockets */ @@ -511,7 +511,7 @@ int mac_selinux_apply(const char *path, const char *label) { int r = 0; #ifdef HAVE_SELINUX - if (!use_selinux()) + if (!mac_selinux_use()) return 0; r = setfilecon(path, (char *)label); diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h index b23a77950..0ce088df7 100644 --- a/src/shared/selinux-util.h +++ b/src/shared/selinux-util.h @@ -25,13 +25,14 @@ #include #include -bool use_selinux(void); -void retest_selinux(void); +bool mac_selinux_use(void); +void mac_selinux_retest(void); int mac_selinux_init(const char *prefix); -int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs); void mac_selinux_finish(void); +int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs); + int mac_selinux_socket_set(const char *label); void mac_selinux_socket_clear(void); diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c index 33e1cd849..0bedd7508 100644 --- a/src/shared/smack-util.c +++ b/src/shared/smack-util.c @@ -27,14 +27,14 @@ #include "path-util.h" #include "smack-util.h" -bool use_smack(void) { +bool mac_smack_use(void) { #ifdef HAVE_SMACK - static int use_smack_cached = -1; + static int cached_use = -1; - if (use_smack_cached < 0) - use_smack_cached = access("/sys/fs/smackfs/", F_OK) >= 0; + if (cached_use < 0) + cached_use = access("/sys/fs/smackfs/", F_OK) >= 0; - return use_smack_cached; + return cached_use; #else return false; #endif @@ -43,7 +43,7 @@ bool use_smack(void) { int mac_smack_set_path(const char *path, const char *label) { #ifdef HAVE_SMACK - if (!use_smack()) + if (!mac_smack_use()) return 0; if (label) @@ -57,7 +57,7 @@ int mac_smack_set_path(const char *path, const char *label) { int mac_smack_set_fd(int fd, const char *label) { #ifdef HAVE_SMACK - if (!use_smack()) + if (!mac_smack_use()) return 0; return fsetxattr(fd, "security.SMACK64", label, strlen(label), 0); @@ -68,7 +68,7 @@ int mac_smack_set_fd(int fd, const char *label) { int mac_smack_set_ip_out_fd(int fd, const char *label) { #ifdef HAVE_SMACK - if (!use_smack()) + if (!mac_smack_use()) return 0; return fsetxattr(fd, "security.SMACK64IPOUT", label, strlen(label), 0); @@ -79,7 +79,7 @@ int mac_smack_set_ip_out_fd(int fd, const char *label) { int mac_smack_set_ip_in_fd(int fd, const char *label) { #ifdef HAVE_SMACK - if (!use_smack()) + if (!mac_smack_use()) return 0; return fsetxattr(fd, "security.SMACK64IPIN", label, strlen(label), 0); diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h index 91b141ad7..50cb79a72 100644 --- a/src/shared/smack-util.h +++ b/src/shared/smack-util.h @@ -28,7 +28,7 @@ #define SMACK_FLOOR_LABEL "_" #define SMACK_STAR_LABEL "*" -bool use_smack(void); +bool mac_smack_use(void); int mac_smack_set_path(const char *path, const char *label); int mac_smack_set_fd(int fd, const char *label); -- 2.30.2