alexk / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
2a5b6a
From d519580bd638ceb48829ae66557ca3c5941b4a5f Mon Sep 17 00:00:00 2001
2a5b6a
From: Florian Festi <ffesti@redhat.com>
2a5b6a
Date: Wed, 4 May 2016 14:05:06 +0200
2a5b6a
Subject: [PATCH] Set permissions before moving new files to their final place
2a5b6a
2a5b6a
---
2a5b6a
 lib/fsm.c | 37 ++++++++++++++++++++-----------------
2a5b6a
 1 file changed, 20 insertions(+), 17 deletions(-)
2a5b6a
2a5b6a
diff --git a/lib/fsm.c b/lib/fsm.c
2a5b6a
index 1ee7e67..3bb23a4 100644
2a5b6a
--- a/lib/fsm.c
2a5b6a
+++ b/lib/fsm.c
2a5b6a
@@ -621,14 +621,15 @@ static FSM_t fsmFree(FSM_t fsm)
2a5b6a
 
2a5b6a
 /* Find and set file security context */
2a5b6a
 static int fsmSetSELabel(struct selabel_handle *sehandle,
2a5b6a
-			 const char *path, mode_t mode)
2a5b6a
+			 const char *path, const char * nominalpath,
2a5b6a
+			 mode_t mode)
2a5b6a
 {
2a5b6a
     int rc = 0;
2a5b6a
 #if WITH_SELINUX
2a5b6a
     if (sehandle) {
2a5b6a
 	security_context_t scon = NULL;
2a5b6a
 
2a5b6a
-	if (selabel_lookup_raw(sehandle, &scon, path, mode) == 0) {
2a5b6a
+	if (selabel_lookup_raw(sehandle, &scon, nominalpath, mode) == 0) {
2a5b6a
 	    rc = lsetfilecon(path, scon);
2a5b6a
 
2a5b6a
 	    if (_fsm_debug) {
2a5b6a
@@ -1215,7 +1216,7 @@ static int fsmMkdirs(rpmfi fi, rpmfs fs, struct selabel_handle *sehandle)
2a5b6a
 		mode_t mode = S_IFDIR | (_dirPerms & 07777);
2a5b6a
 		rc = fsmMkdir(dn, mode);
2a5b6a
 		if (!rc) {
2a5b6a
-		    rc = fsmSetSELabel(sehandle, dn, mode);
2a5b6a
+		    rc = fsmSetSELabel(sehandle, dn, dn, mode);
2a5b6a
 
2a5b6a
 		    rpmlog(RPMLOG_DEBUG,
2a5b6a
 			    "%s directory created with perms %04o\n",
2a5b6a
@@ -1534,22 +1535,11 @@ static int fsmCommit(FSM_t fsm, int ix)
2a5b6a
 	/* Backup on-disk file if needed. Directories are handled earlier */
2a5b6a
 	if (!S_ISDIR(st->st_mode))
2a5b6a
 	    rc = fsmBackup(fsm);
2a5b6a
-        /* Rename temporary to final file name. */
2a5b6a
-        if (!S_ISDIR(st->st_mode) && (fsm->suffix || fsm->nsuffix)) {
2a5b6a
-            char *npath = fsmFsPath(fsm, 0, fsm->nsuffix);
2a5b6a
-            rc = fsmRename(fsm->path, npath, fsm->mapFlags);
2a5b6a
-            if (!rc && fsm->nsuffix) {
2a5b6a
-                char * opath = fsmFsPath(fsm, 0, NULL);
2a5b6a
-                rpmlog(RPMLOG_WARNING, _("%s created as %s\n"),
2a5b6a
-                       opath, npath);
2a5b6a
-                free(opath);
2a5b6a
-            }
2a5b6a
-            free(fsm->path);
2a5b6a
-            fsm->path = npath;
2a5b6a
-        }
2a5b6a
         /* Set file security context (if enabled) */
2a5b6a
         if (!rc && !getuid()) {
2a5b6a
-            rc = fsmSetSELabel(fsm->sehandle, fsm->path, fsm->sb.st_mode);
2a5b6a
+	    char * opath = fsmFsPath(fsm, 0, NULL);
2a5b6a
+	    rc = fsmSetSELabel(fsm->sehandle, fsm->path, opath, fsm->sb.st_mode);
2a5b6a
+	    opath = _free(opath);
2a5b6a
         }
2a5b6a
         if (S_ISLNK(st->st_mode)) {
2a5b6a
             if (!rc && !getuid())
2a5b6a
@@ -1571,6 +1561,19 @@ static int fsmCommit(FSM_t fsm, int ix)
2a5b6a
                 rc = fsmSetFCaps(fsm->path, rpmfiFCapsIndex(fi, ix));
2a5b6a
             }
2a5b6a
         }
2a5b6a
+        /* Rename temporary to final file name. */
2a5b6a
+        if (!rc && !S_ISDIR(st->st_mode) && (fsm->suffix || fsm->nsuffix)) {
2a5b6a
+            char *npath = fsmFsPath(fsm, 0, fsm->nsuffix);
2a5b6a
+            rc = fsmRename(fsm->path, npath, fsm->mapFlags);
2a5b6a
+            if (!rc && fsm->nsuffix) {
2a5b6a
+                char * opath = fsmFsPath(fsm, 0, NULL);
2a5b6a
+                rpmlog(RPMLOG_WARNING, _("%s created as %s\n"),
2a5b6a
+                       opath, npath);
2a5b6a
+                free(opath);
2a5b6a
+            }
2a5b6a
+            free(fsm->path);
2a5b6a
+            fsm->path = npath;
2a5b6a
+        }
2a5b6a
     }
2a5b6a
 
2a5b6a
     if (rc && fsm->failedFile && *fsm->failedFile == NULL) {
2a5b6a
-- 
2a5b6a
2.5.5
2a5b6a