From 0bbd84e31ec8bbe8d1e28e981c577fd56c8b8664 Mon Sep 17 00:00:00 2001
From: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Date: Sat, 11 May 2019 00:27:06 +0200
Subject: Add SELinux labeling to fstree code

Use libselinux to lookup the context attributes from a file.

Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
---
 lib/Makemodule.am    |   9 +++++
 lib/fstree/selinux.c | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+)
 create mode 100644 lib/fstree/selinux.c

(limited to 'lib')

diff --git a/lib/Makemodule.am b/lib/Makemodule.am
index cd24eae..737b474 100644
--- a/lib/Makemodule.am
+++ b/lib/Makemodule.am
@@ -1,6 +1,8 @@
 libfstree_a_SOURCES = lib/fstree/fstree.c lib/fstree/fstree_from_file.c
 libfstree_a_SOURCES += lib/fstree/fstree_sort.c
 libfstree_a_SOURCES += include/fstree.h
+libfstree_a_CFLAGS = $(AM_CFLAGS)
+libfstree_a_CPPFLAGS = $(AM_CPPFLAGS)
 
 libcompress_a_SOURCES = lib/comp/compressor.c lib/comp/internal.h
 libcompress_a_SOURCES += include/compress.h
@@ -50,4 +52,11 @@ libcompress_a_CFLAGS += $(LZ4_CFLAGS)
 libcompress_a_CPPFLAGS += -DWITH_LZ4
 endif
 
+if WITH_SELINUX
+libfstree_a_SOURCES += lib/fstree/selinux.c
+
+libfstree_a_CFLAGS += $(LIBSELINUX_CFLAGS)
+libfstree_a_CPPFLAGS += -DWITH_SELINUX
+endif
+
 noinst_LIBRARIES += libfstree.a libcompress.a libutil.a libsquashfs.a
diff --git a/lib/fstree/selinux.c b/lib/fstree/selinux.c
new file mode 100644
index 0000000..ef858f2
--- /dev/null
+++ b/lib/fstree/selinux.c
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+#include "fstree.h"
+
+#include <selinux/selinux.h>
+#include <selinux/label.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define XATTR_NAME_SELINUX "security.selinux"
+#define XATTR_VALUE_SELINUX "system_u:object_r:unlabeled_t:s0"
+
+static char *get_path(tree_node_t *node)
+{
+	tree_node_t *it;
+	char *str, *ptr;
+	size_t len = 0;
+
+	if (node->parent == NULL) {
+		str = strdup("/");
+
+		if (str == NULL)
+			goto fail_alloc;
+		return str;
+	}
+
+	for (it = node; it != NULL && it->parent != NULL; it = it->parent) {
+		len += strlen(it->name) + 1;
+	}
+
+	str = malloc(len + 1);
+	if (str == NULL)
+		goto fail_alloc;
+
+	ptr = str + len;
+	*ptr = '\0';
+
+	for (it = node; it != NULL && it->parent != NULL; it = it->parent) {
+		len = strlen(it->name);
+		ptr -= len;
+
+		memcpy(ptr, it->name, len);
+		*(--ptr) = '/';
+	}
+
+	return str;
+fail_alloc:
+	perror("relabeling files");
+	return NULL;
+}
+
+static int relable_node(fstree_t *fs, struct selabel_handle *sehnd,
+			tree_node_t *node)
+{
+	char *context = NULL, *path;
+	tree_node_t *it;
+	int ret;
+
+	path = get_path(node);
+	if (path == NULL)
+		return -1;
+
+	if (selabel_lookup(sehnd, &context, path, node->mode) < 0) {
+		free(path);
+
+		ret = fstree_add_xattr(fs, node, XATTR_NAME_SELINUX,
+				       XATTR_VALUE_SELINUX);
+	} else {
+		free(path);
+		ret = fstree_add_xattr(fs, node, XATTR_NAME_SELINUX, context);
+		free(context);
+	}
+
+	if (ret)
+		return -1;
+
+	if (S_ISDIR(node->mode)) {
+		it = node->data.dir->children;
+
+		while (it != NULL) {
+			if (relable_node(fs, sehnd, it))
+				return -1;
+
+			it = it->next;
+		}
+	}
+
+	return 0;
+}
+
+int fstree_relabel_selinux(fstree_t *fs, const char *filename)
+{
+	struct selabel_handle *sehnd;
+	struct selinux_opt seopts[] = {
+		{ SELABEL_OPT_PATH, filename },
+	};
+	int ret;
+
+	sehnd = selabel_open(SELABEL_CTX_FILE, seopts, 1);
+
+	if (sehnd == NULL) {
+		perror(filename);
+		return -1;
+	}
+
+	ret = relable_node(fs, sehnd, fs->root);
+
+	selabel_close(sehnd);
+	return ret;
+}
-- 
cgit v1.2.3