SE Linux patch(Re: [BusyBox] SE Linux)
Takeharu KATO
takeharu1219 at ybb.ne.jp
Fri Feb 4 22:13:45 UTC 2005
Hi John:
Sorry,I found a bug the patch I send before.
The patch break compilation of top command of busybox in the case of
selinux support off.
Please use the patch attached with this mail.
This patch is tested on IA32 and all configuration on and se-linux off.
Takeharu KATO wrote:
> Hi
>
> I make SE-Linux support feature in busybox worked again.
>
> I did not know how to attach the patch on bug-tracking system,
> so I post this patch to this ML.
>
> If busybox on SE-Linux, please try this patch.
>
> Villalovos, John L wrote:
>
>
>>I checked the latest 2.6 kernel and libselinux-1.20.tgz. Neither one of
>>them seem to contain this proc_secure.h file.
>>
>>Is this include file not valid anymore?
>>
>
> If nobody maintain this feature now, I am willing to maintain this.
> How about this propose?
>
> I show the some execution results as follow:
> -- execution results
> # ls -k /etc
> system_u:object_r:etc_t adjtime
> system_u:object_r:etc_t alchemist
> system_u:object_r:etc_t aliases
> unknown aliases.db
> system_u:object_r:etc_t alsa
> system_u:object_r:etc_t alternatives
> # id
> uid=0(root) gid=0(root) context=root:system_r:unconfined_t
> # ps -c
> PID Context Stat Command
> 1 user_u:system_r:unconfined_t S init [5]
> 2 user_u:system_r:unconfined_t SWN [ksoftirqd/0]
> 3 user_u:system_r:unconfined_t SW< [events/0]
> 4 user_u:system_r:unconfined_t SW< [khelper]
> 5 user_u:system_r:unconfined_t SW< [kacpid]
>
>
> ------------------------------------------------------------------------
>
> diff -Naur busybox-current/Makefile busybox-current.fix/Makefile
> --- busybox-current/Makefile 2004-11-02 18:05:22.000000000 +0900
> +++ busybox-current.fix/Makefile 2005-02-05 02:51:10.000000000 +0900
> @@ -47,8 +47,7 @@
> SRC_DIRS:=$(patsubst %,$(top_srcdir)/%,$(DIRS))
>
> ifeq ($(strip $(CONFIG_SELINUX)),y)
> -CFLAGS += -I/usr/include/selinux
> -LIBRARIES += -lsecure
> +LIBRARIES += -lselinux
> endif
>
> CONFIG_CONFIG_IN = $(top_srcdir)/sysdeps/$(TARGET_OS)/Config.in
> diff -Naur busybox-current/coreutils/id.c busybox-current.fix/coreutils/id.c
> --- busybox-current/coreutils/id.c 2004-09-15 12:04:07.000000000 +0900
> +++ busybox-current.fix/coreutils/id.c 2005-02-05 04:15:45.000000000 +0900
> @@ -32,8 +32,7 @@
> #include <sys/types.h>
>
> #ifdef CONFIG_SELINUX
> -#include <proc_secure.h>
> -#include <flask_util.h>
> +#include <selinux/selinux.h> /* for is_selinux_enabled() */
> #endif
>
> #define PRINT_REAL 1
> @@ -61,9 +60,6 @@
> gid_t gid;
> unsigned long flags;
> short status;
> -#ifdef CONFIG_SELINUX
> - int is_flask_enabled_flag = is_flask_enabled();
> -#endif
>
> bb_opt_complementaly = "u~g:g~u";
> flags = bb_getopt_ulflags(argc, argv, "rnug");
> @@ -110,13 +106,20 @@
> /* my_getgrgid doesn't exit on failure here */
> status|=printf_full(gid, my_getgrgid(NULL, gid, 0), 'g');
> #ifdef CONFIG_SELINUX
> - if(is_flask_enabled_flag) {
> - security_id_t mysid = getsecsid();
> - char context[80];
> - int len = sizeof(context);
> - context[0] = '\0';
> - if(security_sid_to_context(mysid, context, &len))
> - strcpy(context, "unknown");
> + if(is_selinux_enabled()) {
> + security_context_t mysid;
> + char context[80];
> + int len = sizeof(context);
> +
> + getcon(&mysid);
> + context[0] = '\0';
> + if (mysid) {
> + len = strlen(mysid)+1;
> + safe_strncpy(context, mysid, len);
> + freecon(mysid);
> + }else{
> + safe_strncpy(context, "unknown",8);
> + }
> bb_printf(" context=%s", context);
> }
> #endif
> diff -Naur busybox-current/coreutils/ls.c busybox-current.fix/coreutils/ls.c
> --- busybox-current/coreutils/ls.c 2004-09-24 11:04:13.000000000 +0900
> +++ busybox-current.fix/coreutils/ls.c 2005-02-05 04:29:34.000000000 +0900
> @@ -64,9 +64,7 @@
> #include <sys/sysmacros.h> /* major() and minor() */
> #include "busybox.h"
> #ifdef CONFIG_SELINUX
> -#include <fs_secure.h>
> -#include <flask_util.h>
> -#include <ss.h>
> +#include <selinux/selinux.h> /* for is_selinux_enabled() */
> #endif
>
> #ifdef CONFIG_FEATURE_LS_TIMESTAMPS
> @@ -182,7 +180,7 @@
> char *fullname; /* the dir entry name */
> struct stat dstat; /* the file stat info */
> #ifdef CONFIG_SELINUX
> - security_id_t sid;
> + security_context_t sid;
> #endif
> struct dnode *next; /* point at the next node */
> };
> @@ -195,7 +193,7 @@
> static unsigned int all_fmt;
>
> #ifdef CONFIG_SELINUX
> -static int is_flask_enabled_flag;
> +static int selinux_enabled= 0;
> #endif
>
> #ifdef CONFIG_FEATURE_AUTOWIDTH
> @@ -213,18 +211,19 @@
> struct stat dstat;
> struct dnode *cur;
> #ifdef CONFIG_SELINUX
> - security_id_t sid;
> + security_context_t sid=NULL;
> #endif
> int rc;
>
> #ifdef CONFIG_FEATURE_LS_FOLLOWLINKS
> if (all_fmt & FOLLOW_LINKS) {
> #ifdef CONFIG_SELINUX
> - if(is_flask_enabled_flag)
> - rc = stat_secure(fullname, &dstat, &sid);
> - else
> + rc=0; /* Set the number which means success before hand. */
> + if(is_selinux_enabled()) {
> + rc = getfilecon(fullname,&sid);
> + }
> #endif
> - rc = stat(fullname, &dstat);
> + rc = stat(fullname, &dstat);
> if(rc)
> {
> bb_perror_msg("%s", fullname);
> @@ -235,11 +234,12 @@
> #endif
> {
> #ifdef CONFIG_SELINUX
> - if(is_flask_enabled_flag)
> - rc = lstat_secure(fullname, &dstat, &sid);
> - else
> + rc=0; /* Set the number which means success before hand. */
> + if(is_selinux_enabled()) {
> + rc = lgetfilecon(fullname,&sid);
> + }
> #endif
> - rc = lstat(fullname, &dstat);
> + rc = lstat(fullname, &dstat);
> if(rc)
> {
> bb_perror_msg("%s", fullname);
> @@ -736,12 +736,16 @@
> #ifdef CONFIG_SELINUX
> case LIST_CONTEXT:
> {
> - char context[64];
> - int len = sizeof(context);
> - if(security_sid_to_context(dn->sid, context, &len))
> - {
> - strcpy(context, "unknown");
> - len = 7;
> + char context[80];
> + int len;
> +
> + if (dn->sid) {
> + /* I assume sid initilized with NULL */
> + len = strlen(dn->sid)+1;
> + safe_strncpy(context, dn->sid, len);
> + freecon(dn->sid);
> + }else {
> + safe_strncpy(context, "unknown",8);
> }
> printf("%-32s ", context);
> column += MAX(33, len);
> @@ -963,10 +967,6 @@
> char *terminal_width_str = NULL;
> #endif
>
> -#ifdef CONFIG_SELINUX
> - is_flask_enabled_flag = is_flask_enabled();
> -#endif
> -
> all_fmt = LIST_SHORT | DISP_NORMAL | STYLE_AUTO
> #ifdef CONFIG_FEATURE_LS_TIMESTAMPS
> | TIME_MOD
> diff -Naur busybox-current/include/libbb.h busybox-current.fix/include/libbb.h
> --- busybox-current/include/libbb.h 2005-01-24 16:00:00.000000000 +0900
> +++ busybox-current.fix/include/libbb.h 2005-02-05 04:00:22.000000000 +0900
> @@ -43,7 +43,7 @@
>
> #include "config.h"
> #ifdef CONFIG_SELINUX
> -#include <proc_secure.h>
> +#include <selinux/selinux.h>
> #endif
>
> #include "pwd_.h"
> @@ -424,7 +424,7 @@
> extern const char *change_identity_e2str ( const struct passwd *pw );
> extern void run_shell ( const char *shell, int loginshell, const char *command, const char **additional_args
> #ifdef CONFIG_SELINUX
> - , security_id_t sid
> + , security_context_t sid
> #endif
> );
> extern int run_parts(char **args, const unsigned char test_mode, char **env);
> @@ -459,7 +459,7 @@
>
> extern procps_status_t * procps_scan(int save_user_arg0
> #ifdef CONFIG_SELINUX
> - , int use_selinux, security_id_t *sid
> + , int use_selinux, security_context_t *sid
> #endif
> );
> extern unsigned short compare_string_array(const char *string_array[], const char *key);
> diff -Naur busybox-current/libbb/find_pid_by_name.c busybox-current.fix/libbb/find_pid_by_name.c
> --- busybox-current/libbb/find_pid_by_name.c 2004-03-15 17:28:42.000000000 +0900
> +++ busybox-current.fix/libbb/find_pid_by_name.c 2005-02-05 04:08:26.000000000 +0900
> @@ -46,7 +46,8 @@
>
> pidList = xmalloc(sizeof(long));
> #ifdef CONFIG_SELINUX
> - while ((p = procps_scan(0, 0, NULL)) != 0) {
> + security_context_t sid=NULL;
> + while ((p = procps_scan(0, 0,&sid)) != 0) {
> #else
> while ((p = procps_scan(0)) != 0) {
> #endif
> diff -Naur busybox-current/libbb/procps.c busybox-current.fix/libbb/procps.c
> --- busybox-current/libbb/procps.c 2004-08-27 07:18:58.000000000 +0900
> +++ busybox-current.fix/libbb/procps.c 2005-02-05 04:06:54.000000000 +0900
> @@ -13,12 +13,15 @@
> #include <stdlib.h>
> #include <unistd.h>
> #include <asm/page.h>
> +#ifdef CONFIG_SELINUX
> +#include <selinux/selinux.h> /* for fgetfilecon */
> +#endif
>
> #include "libbb.h"
>
> extern procps_status_t * procps_scan(int save_user_arg0
> #ifdef CONFIG_SELINUX
> - , int use_selinux , security_id_t *sid
> + , int use_selinux, security_context_t *sid
> #endif
> )
> {
> @@ -60,16 +63,17 @@
> my_getpwuid(curstatus.user, sb.st_uid, sizeof(curstatus.user));
>
> sprintf(status, "/proc/%d/stat", pid);
> - if((fp = fopen(status, "r")) == NULL)
> - continue;
> #ifdef CONFIG_SELINUX
> if(use_selinux)
> {
> - if(fstat_secure(fileno(fp), &sb, sid))
> - continue;
> + if (is_selinux_enabled()) {
> + if (getpidcon(pid,sid)<0)
> + continue;
> + }
> }
> - else
> #endif
> + if((fp = fopen(status, "r")) == NULL)
> + continue;
> name = fgets(buf, sizeof(buf), fp);
> fclose(fp);
> if(name == NULL)
> diff -Naur busybox-current/libbb/run_shell.c busybox-current.fix/libbb/run_shell.c
> --- busybox-current/libbb/run_shell.c 2004-03-15 17:28:43.000000000 +0900
> +++ busybox-current.fix/libbb/run_shell.c 2005-02-05 04:20:58.000000000 +0900
> @@ -37,7 +37,7 @@
> #include <ctype.h>
> #include "libbb.h"
> #ifdef CONFIG_SELINUX
> -#include <proc_secure.h>
> +#include <selinux/selinux.h> /* for setexeccon */
> #endif
>
> /* Run SHELL, or DEFAULT_SHELL if SHELL is empty.
> @@ -47,7 +47,7 @@
>
> void run_shell ( const char *shell, int loginshell, const char *command, const char **additional_args
> #ifdef CONFIG_SELINUX
> - , security_id_t sid
> + , security_context_t sid
> #endif
> )
> {
> @@ -78,9 +78,10 @@
> }
> args [argno] = 0;
> #ifdef CONFIG_SELINUX
> - if(sid)
> - execve_secure(shell, (char **) args, environ, sid);
> - else
> + if ( (sid) && (!setexeccon(sid)) ) {
> + freecon(sid);
> + execve(shell, (char **) args, environ);
> + } else
> #endif
> execv ( shell, (char **) args );
> bb_perror_msg_and_die ( "cannot run %s", shell );
> diff -Naur busybox-current/loginutils/login.c busybox-current.fix/loginutils/login.c
> --- busybox-current/loginutils/login.c 2004-08-27 07:26:26.000000000 +0900
> +++ busybox-current.fix/loginutils/login.c 2005-02-05 04:18:04.000000000 +0900
> @@ -17,10 +17,10 @@
>
> #include "busybox.h"
> #ifdef CONFIG_SELINUX
> -#include <flask_util.h>
> -#include <get_sid_list.h>
> -#include <proc_secure.h>
> -#include <fs_secure.h>
> +#include <selinux/selinux.h> /* for is_selinux_enabled() */
> +#include <selinux/get_context_list.h> /* for get_default_context() */
> +#include <selinux/flask.h> /* for security class definitions */
> +#include <errno.h>
> #endif
>
> #ifdef CONFIG_FEATURE_U_W_TMP
> @@ -79,8 +79,7 @@
> char *opt_host = 0;
> int alarmstarted = 0;
> #ifdef CONFIG_SELINUX
> - int flask_enabled = is_flask_enabled();
> - security_id_t sid = 0, old_tty_sid, new_tty_sid;
> + security_context_t stat_sid = NULL, sid = NULL, old_tty_sid=NULL, new_tty_sid=NULL;
> #endif
>
> username[0]=0;
> @@ -226,33 +225,37 @@
> setutmp ( username, tty );
> #endif
> #ifdef CONFIG_SELINUX
> - if (flask_enabled)
> + if (is_selinux_enabled())
> {
> struct stat st;
> -
> - if (get_default_sid(username, 0, &sid))
> + int rc;
> +
> + if (get_default_context(username, NULL, &sid))
> {
> fprintf(stderr, "Unable to get SID for %s\n", username);
> exit(1);
> }
> - if (stat_secure(tty, &st, &old_tty_sid))
> + rc = getfilecon(tty,&stat_sid);
> + freecon(stat_sid);
> + if ((rc<0) || (stat(tty, &st)<0))
> {
> fprintf(stderr, "stat_secure(%.100s) failed: %.100s\n", tty, strerror(errno));
> return EXIT_FAILURE;
> }
> - if (security_change_sid (sid, old_tty_sid, SECCLASS_CHR_FILE, &new_tty_sid) != 0)
> + if (security_compute_relabel (sid, old_tty_sid, SECCLASS_CHR_FILE, &new_tty_sid) != 0)
> {
> fprintf(stderr, "security_change_sid(%.100s) failed: %.100s\n", tty, strerror(errno));
> return EXIT_FAILURE;
> }
> - if(chsid(tty, new_tty_sid) != 0)
> + if(setfilecon(tty, new_tty_sid) != 0)
> {
> - fprintf(stderr, "chsid(%.100s, %d) failed: %.100s\n", tty, new_tty_sid, strerror(errno));
> + fprintf(stderr, "chsid(%.100s, %s) failed: %.100s\n", tty, new_tty_sid, strerror(errno));
> return EXIT_FAILURE;
> }
> + freecon(sid);
> + freecon(old_tty_sid);
> + freecon(new_tty_sid);
> }
> - else
> - sid = 0;
> #endif
>
> if ( *tty != '/' )
> diff -Naur busybox-current/loginutils/su.c busybox-current.fix/loginutils/su.c
> --- busybox-current/loginutils/su.c 2004-03-15 17:28:46.000000000 +0900
> +++ busybox-current.fix/loginutils/su.c 2005-02-05 02:17:58.000000000 +0900
> @@ -149,7 +149,7 @@
> setup_environment ( opt_shell, opt_loginshell, !opt_preserve, pw );
> run_shell ( opt_shell, opt_loginshell, opt_command, (const char**)opt_args
> #ifdef CONFIG_SELINUX
> - , 0
> + , NULL
> #endif
> );
>
> diff -Naur busybox-current/loginutils/sulogin.c busybox-current.fix/loginutils/sulogin.c
> --- busybox-current/loginutils/sulogin.c 2004-05-01 10:27:30.000000000 +0900
> +++ busybox-current.fix/loginutils/sulogin.c 2005-02-05 02:48:54.000000000 +0900
> @@ -61,7 +61,9 @@
> #ifdef CONFIG_FEATURE_SHADOWPASSWDS
> struct spwd *spwd = NULL;
> #endif /* CONFIG_FEATURE_SHADOWPASSWDS */
> -
> +#ifdef CONFIG_SELINUX
> + security_context_t sid;
> +#endif
> openlog("sulogin", LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_AUTH);
> if (argc > 1) {
> if (strncmp(argv[1], "-t", 2) == 0) {
> @@ -153,6 +155,13 @@
> puts("Entering System Maintenance Mode\n");
> fflush(stdout);
> syslog(LOG_INFO, "System Maintenance Mode\n");
> - run_shell(pwent.pw_shell, 1, 0, 0);
> +#ifdef CONFIG_SELINUX
> + getcon(&sid);
> +#endif
> + run_shell(pwent.pw_shell, 1, 0, 0
> +#ifdef CONFIG_SELINUX
> + , sid
> +#endif
> + );
> return (0);
> }
> diff -Naur busybox-current/procps/ps.c busybox-current.fix/procps/ps.c
> --- busybox-current/procps/ps.c 2004-03-15 17:29:03.000000000 +0900
> +++ busybox-current.fix/procps/ps.c 2005-02-05 04:12:42.000000000 +0900
> @@ -31,9 +31,7 @@
> #include <sys/ioctl.h>
> #include "busybox.h"
> #ifdef CONFIG_SELINUX
> -#include <fs_secure.h>
> -#include <ss.h>
> -#include <flask_util.h> /* for is_flask_enabled() */
> +#include <selinux/selinux.h> /* for is_selinux_enabled() */
> #endif
>
> static const int TERMINAL_WIDTH = 79; /* not 80 in case terminal has linefold bug */
> @@ -48,8 +46,8 @@
>
> #ifdef CONFIG_SELINUX
> int use_selinux = 0;
> - security_id_t sid;
> - if(is_flask_enabled() && argv[1] && !strcmp(argv[1], "-c") )
> + security_context_t sid=NULL;
> + if(is_selinux_enabled() && argv[1] && !strcmp(argv[1], "-c") )
> use_selinux = 1;
> #endif
>
> @@ -58,13 +56,13 @@
> terminal_width--;
>
> #ifdef CONFIG_SELINUX
> - if(use_selinux)
> - printf(" PID Context Stat Command\n");
> + if (use_selinux)
> + printf(" PID Context Stat Command\n");
> else
> #endif
> - printf(" PID Uid VmSize Stat Command\n");
> + printf(" PID Uid VmSize Stat Command\n");
> #ifdef CONFIG_SELINUX
> - while ((p = procps_scan(1, use_selinux, &sid)) != 0) {
> + while ((p = procps_scan(1, use_selinux,&sid)) != 0) {
> #else
> while ((p = procps_scan(1)) != 0) {
> #endif
> @@ -75,9 +73,16 @@
> {
> char sbuf[128];
> len = sizeof(sbuf);
> - if(security_sid_to_context(sid, (security_context_t)&sbuf, &len))
> - strcpy(sbuf, "unknown");
>
> + if (sid) {
> + /* I assume sid initilized with NULL */
> + len = strlen(sid)+1;
> + safe_strncpy(sbuf, sid, len);
> + freecon(sid);
> + sid=NULL;
> + }else {
> + safe_strncpy(sbuf, "unknown",7);
> + }
> len = printf("%5d %-32s %s ", p->pid, sbuf, p->state);
> }
> else
> diff -Naur busybox-current/procps/top.c busybox-current.fix/procps/top.c
> --- busybox-current/procps/top.c 2004-09-15 04:14:00.000000000 +0900
> +++ busybox-current.fix/procps/top.c 2005-02-05 04:22:22.000000000 +0900
> @@ -511,7 +511,8 @@
> procps_status_t * p;
>
> #ifdef CONFIG_SELINUX
> - while ((p = procps_scan(0, 0, NULL) ) != 0) {
> + security_context_t sid=NULL;
> + while ((p = procps_scan(0, 0,&sid) ) != 0) {
> #else
> while ((p = procps_scan(0)) != 0) {
> #endif
> @@ -519,6 +520,8 @@
>
> top = xrealloc(top, (++ntop)*sizeof(procps_status_t));
> memcpy(top + n, p, sizeof(procps_status_t));
> + freecon(sid);
> + sid=NULL;
> }
> if (ntop == 0) {
> bb_perror_msg_and_die("scandir('/proc')");
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> busybox mailing list
> busybox at mail.busybox.net
> http://busybox.net/mailman/listinfo/busybox
--
Takeharu KATO
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: busybox-selinux-new.patch
Url: http://lists.busybox.net/pipermail/busybox/attachments/20050205/f7e94d55/attachment.diff
More information about the busybox
mailing list