summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-05-11 00:27:06 +0200
committerDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-05-19 14:27:34 +0200
commit0bbd84e31ec8bbe8d1e28e981c577fd56c8b8664 (patch)
tree67fa887d11c60c126ab04e66f4f970e2dfb66dc0 /lib
parent7097dda129654a5e054c1d64e72bfd189b4964b2 (diff)
Add SELinux labeling to fstree code
Use libselinux to lookup the context attributes from a file. Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Diffstat (limited to 'lib')
-rw-r--r--lib/Makemodule.am9
-rw-r--r--lib/fstree/selinux.c110
2 files changed, 119 insertions, 0 deletions
diff --git a/lib/Makemodule.am b/lib/Makemodule.am
index cd24eae..737b474 100644
--- a/lib/Makemodule.am
+++ b/lib/Makemodule.am
@@ -1,6 +1,8 @@
libfstree_a_SOURCES = lib/fstree/fstree.c lib/fstree/fstree_from_file.c
libfstree_a_SOURCES += lib/fstree/fstree_sort.c
libfstree_a_SOURCES += include/fstree.h
+libfstree_a_CFLAGS = $(AM_CFLAGS)
+libfstree_a_CPPFLAGS = $(AM_CPPFLAGS)
libcompress_a_SOURCES = lib/comp/compressor.c lib/comp/internal.h
libcompress_a_SOURCES += include/compress.h
@@ -50,4 +52,11 @@ libcompress_a_CFLAGS += $(LZ4_CFLAGS)
libcompress_a_CPPFLAGS += -DWITH_LZ4
endif
+if WITH_SELINUX
+libfstree_a_SOURCES += lib/fstree/selinux.c
+
+libfstree_a_CFLAGS += $(LIBSELINUX_CFLAGS)
+libfstree_a_CPPFLAGS += -DWITH_SELINUX
+endif
+
noinst_LIBRARIES += libfstree.a libcompress.a libutil.a libsquashfs.a
diff --git a/lib/fstree/selinux.c b/lib/fstree/selinux.c
new file mode 100644
index 0000000..ef858f2
--- /dev/null
+++ b/lib/fstree/selinux.c
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+#include "fstree.h"
+
+#include <selinux/selinux.h>
+#include <selinux/label.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define XATTR_NAME_SELINUX "security.selinux"
+#define XATTR_VALUE_SELINUX "system_u:object_r:unlabeled_t:s0"
+
+static char *get_path(tree_node_t *node)
+{
+ tree_node_t *it;
+ char *str, *ptr;
+ size_t len = 0;
+
+ if (node->parent == NULL) {
+ str = strdup("/");
+
+ if (str == NULL)
+ goto fail_alloc;
+ return str;
+ }
+
+ for (it = node; it != NULL && it->parent != NULL; it = it->parent) {
+ len += strlen(it->name) + 1;
+ }
+
+ str = malloc(len + 1);
+ if (str == NULL)
+ goto fail_alloc;
+
+ ptr = str + len;
+ *ptr = '\0';
+
+ for (it = node; it != NULL && it->parent != NULL; it = it->parent) {
+ len = strlen(it->name);
+ ptr -= len;
+
+ memcpy(ptr, it->name, len);
+ *(--ptr) = '/';
+ }
+
+ return str;
+fail_alloc:
+ perror("relabeling files");
+ return NULL;
+}
+
+static int relable_node(fstree_t *fs, struct selabel_handle *sehnd,
+ tree_node_t *node)
+{
+ char *context = NULL, *path;
+ tree_node_t *it;
+ int ret;
+
+ path = get_path(node);
+ if (path == NULL)
+ return -1;
+
+ if (selabel_lookup(sehnd, &context, path, node->mode) < 0) {
+ free(path);
+
+ ret = fstree_add_xattr(fs, node, XATTR_NAME_SELINUX,
+ XATTR_VALUE_SELINUX);
+ } else {
+ free(path);
+ ret = fstree_add_xattr(fs, node, XATTR_NAME_SELINUX, context);
+ free(context);
+ }
+
+ if (ret)
+ return -1;
+
+ if (S_ISDIR(node->mode)) {
+ it = node->data.dir->children;
+
+ while (it != NULL) {
+ if (relable_node(fs, sehnd, it))
+ return -1;
+
+ it = it->next;
+ }
+ }
+
+ return 0;
+}
+
+int fstree_relabel_selinux(fstree_t *fs, const char *filename)
+{
+ struct selabel_handle *sehnd;
+ struct selinux_opt seopts[] = {
+ { SELABEL_OPT_PATH, filename },
+ };
+ int ret;
+
+ sehnd = selabel_open(SELABEL_CTX_FILE, seopts, 1);
+
+ if (sehnd == NULL) {
+ perror(filename);
+ return -1;
+ }
+
+ ret = relable_node(fs, sehnd, fs->root);
+
+ selabel_close(sehnd);
+ return ret;
+}