176 lines
3.7 KiB
C
176 lines
3.7 KiB
C
/*
|
|
* Copyright (C) 2004 Daniel Walsh
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation version 2 of the License.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <stddef.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <fcntl.h>
|
|
#include <ctype.h>
|
|
#include <limits.h>
|
|
#include <errno.h>
|
|
#include <sys/stat.h>
|
|
#include <selinux/selinux.h>
|
|
|
|
#include "udev.h"
|
|
#include "udev_selinux.h"
|
|
|
|
static security_context_t prev_scontext = NULL;
|
|
|
|
static int is_selinux_running(void)
|
|
{
|
|
static int selinux_enabled = -1;
|
|
|
|
if (selinux_enabled == -1)
|
|
selinux_enabled = (is_selinux_enabled() > 0);
|
|
|
|
dbg("selinux=%i\n", selinux_enabled);
|
|
return selinux_enabled;
|
|
}
|
|
|
|
static char *get_media(const char *devname, int mode)
|
|
{
|
|
FILE *fp;
|
|
char procfile[PATH_MAX];
|
|
char mediabuf[256];
|
|
int size;
|
|
char *media = NULL;
|
|
|
|
if (!(mode & S_IFBLK))
|
|
return NULL;
|
|
|
|
snprintf(procfile, PATH_MAX, "/proc/ide/%s/media", devname);
|
|
procfile[PATH_MAX-1] = '\0';
|
|
|
|
fp = fopen(procfile, "r");
|
|
if (!fp)
|
|
goto out;
|
|
|
|
if (fgets(mediabuf, sizeof(mediabuf), fp) == NULL)
|
|
goto close_out;
|
|
|
|
size = strlen(mediabuf);
|
|
while (size-- > 0) {
|
|
if (isspace(mediabuf[size])) {
|
|
mediabuf[size] = '\0';
|
|
} else {
|
|
break;
|
|
}
|
|
}
|
|
|
|
media = strdup(mediabuf);
|
|
info("selinux_get_media(%s)='%s'\n", devname, media);
|
|
|
|
close_out:
|
|
fclose(fp);
|
|
out:
|
|
return media;
|
|
}
|
|
|
|
void selinux_setfilecon(const char *file, const char *devname, unsigned int mode)
|
|
{
|
|
if (is_selinux_running()) {
|
|
security_context_t scontext = NULL;
|
|
char *media;
|
|
int ret = -1;
|
|
|
|
if (devname) {
|
|
media = get_media(devname, mode);
|
|
if (media) {
|
|
ret = matchmediacon(media, &scontext);
|
|
free(media);
|
|
}
|
|
}
|
|
|
|
if (ret < 0)
|
|
if (matchpathcon(file, mode, &scontext) < 0) {
|
|
err("matchpathcon(%s) failed\n", file);
|
|
return;
|
|
}
|
|
|
|
if (lsetfilecon(file, scontext) < 0)
|
|
err("setfilecon %s failed: %s\n", file, strerror(errno));
|
|
|
|
freecon(scontext);
|
|
}
|
|
}
|
|
|
|
void selinux_setfscreatecon(const char *file, const char *devname, unsigned int mode)
|
|
{
|
|
if (is_selinux_running()) {
|
|
security_context_t scontext = NULL;
|
|
char *media;
|
|
int ret = -1;
|
|
|
|
if (devname) {
|
|
media = get_media(devname, mode);
|
|
if (media) {
|
|
ret = matchmediacon(media, &scontext);
|
|
free(media);
|
|
}
|
|
}
|
|
|
|
if (ret < 0)
|
|
if (matchpathcon(file, mode, &scontext) < 0) {
|
|
err("matchpathcon(%s) failed\n", file);
|
|
return;
|
|
}
|
|
|
|
if (setfscreatecon(scontext) < 0)
|
|
err("setfscreatecon %s failed: %s\n", file, strerror(errno));
|
|
|
|
freecon(scontext);
|
|
}
|
|
}
|
|
|
|
void selinux_resetfscreatecon(void)
|
|
{
|
|
if (is_selinux_running()) {
|
|
if (setfscreatecon(prev_scontext) < 0)
|
|
err("setfscreatecon failed: %s\n", strerror(errno));
|
|
}
|
|
}
|
|
|
|
void selinux_init(void)
|
|
{
|
|
/*
|
|
* record the present security context, for file-creation
|
|
* restoration creation purposes.
|
|
*/
|
|
if (is_selinux_running()) {
|
|
if (!udev_root[0])
|
|
err("selinux_init: udev_root not set\n");
|
|
matchpathcon_init_prefix(NULL, udev_root);
|
|
if (getfscreatecon(&prev_scontext) < 0) {
|
|
err("getfscreatecon failed\n");
|
|
prev_scontext = NULL;
|
|
}
|
|
}
|
|
}
|
|
|
|
void selinux_exit(void)
|
|
{
|
|
if (is_selinux_running() && prev_scontext) {
|
|
freecon(prev_scontext);
|
|
prev_scontext = NULL;
|
|
}
|
|
}
|