dcavalca / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
Florian Festi 63a09f
From 96888e99c5103d9dea5230c917b946732de2d302 Mon Sep 17 00:00:00 2001
Florian Festi 63a09f
From: Panu Matilainen <pmatilai@redhat.com>
Florian Festi 63a09f
Date: Thu, 22 Sep 2022 11:54:47 +0300
Florian Festi 63a09f
Subject: [PATCH] Add a handler for libselinux log messages (RhBug:2123719,
Florian Festi 63a09f
 RhBug:2050774)
Florian Festi 63a09f
Florian Festi 63a09f
libselinux logs to stderr by default, which up to now has been just fine
Florian Festi 63a09f
with us. However somewhere around libselinux 3.2 it begun issuing
Florian Festi 63a09f
log messages for events discovered in selinux_status_updated().
Florian Festi 63a09f
We only call that to see whether the status *was* updated behind our
Florian Festi 63a09f
back and are not interested in these audit-style messages for our
Florian Festi 63a09f
functionality, but to suppress them while preserving actually relevant
Florian Festi 63a09f
errors and warnings, we need to have a log callback of our own. Might as
Florian Festi 63a09f
well forward them to rpmlog then.
Florian Festi 63a09f
Florian Festi 63a09f
SELINUX_ERROR and SELINUX_WARNING are pretty obvious, of SELINUX_AVC
Florian Festi 63a09f
selinux_set_callback(3) says it should be treated as SELINUX_ERROR if
Florian Festi 63a09f
not audited. The rest we suppress to debug messages, they may be handy
Florian Festi 63a09f
for diagnostics some day.
Florian Festi 63a09f
Florian Festi 63a09f
Note that this intentionally avoids explicit SELINUX_POLICYLOAD and
Florian Festi 63a09f
SELINUX_SETENFORCE cases in the switch: we don't want to introduce
Florian Festi 63a09f
libselinux >= 3.2 dependency just because of this silly thing.
Florian Festi 63a09f
---
Florian Festi 63a09f
 plugins/selinux.c | 30 ++++++++++++++++++++++++++++++
Florian Festi 63a09f
 1 file changed, 30 insertions(+)
Florian Festi 63a09f
Florian Festi 63a09f
diff --git a/plugins/selinux.c b/plugins/selinux.c
Florian Festi 63a09f
index 747f62d05..0f10331f0 100644
Florian Festi 63a09f
--- a/plugins/selinux.c
Florian Festi 63a09f
+++ b/plugins/selinux.c
Florian Festi 63a09f
@@ -18,6 +18,35 @@ static inline rpmlogLvl loglvl(int iserror)
Florian Festi 63a09f
     return iserror ? RPMLOG_ERR : RPMLOG_DEBUG;
Florian Festi 63a09f
 }
Florian Festi 63a09f
 
Florian Festi 63a09f
+static int logcb(int type, const char *fmt, ...)
Florian Festi 63a09f
+{
Florian Festi 63a09f
+    char *buf = NULL;
Florian Festi 63a09f
+    va_list ap;
Florian Festi 63a09f
+    int lvl;
Florian Festi 63a09f
+
Florian Festi 63a09f
+    switch (type) {
Florian Festi 63a09f
+    case SELINUX_ERROR:
Florian Festi 63a09f
+    case SELINUX_AVC:
Florian Festi 63a09f
+	lvl = RPMLOG_ERR;
Florian Festi 63a09f
+	break;
Florian Festi 63a09f
+    case SELINUX_WARNING:
Florian Festi 63a09f
+	lvl = RPMLOG_WARNING;
Florian Festi 63a09f
+	break;
Florian Festi 63a09f
+    default:
Florian Festi 63a09f
+	lvl = RPMLOG_DEBUG;
Florian Festi 63a09f
+	break;
Florian Festi 63a09f
+    }
Florian Festi 63a09f
+
Florian Festi 63a09f
+    va_start(ap, fmt);
Florian Festi 63a09f
+    rvasprintf(&buf, fmt, ap);
Florian Festi 63a09f
+    va_end(ap);
Florian Festi 63a09f
+
Florian Festi 63a09f
+    rpmlog(lvl, "libselinux: type %d: %s", type, buf);
Florian Festi 63a09f
+    free(buf);
Florian Festi 63a09f
+
Florian Festi 63a09f
+    return 0;
Florian Festi 63a09f
+}
Florian Festi 63a09f
+
Florian Festi 63a09f
 static void sehandle_fini(int close_status)
Florian Festi 63a09f
 {
Florian Festi 63a09f
     if (sehandle) {
Florian Festi 63a09f
@@ -44,6 +73,7 @@ static rpmRC sehandle_init(int open_status)
Florian Festi 63a09f
 	if (selinux_status_open(0) < 0) {
Florian Festi 63a09f
 	    return RPMRC_FAIL;
Florian Festi 63a09f
 	}
Florian Festi 63a09f
+	selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &logcb);
Florian Festi 63a09f
     } else if (!selinux_status_updated() && sehandle) {
Florian Festi 63a09f
 	return RPMRC_OK;
Florian Festi 63a09f
     }
Florian Festi 63a09f
-- 
Florian Festi 63a09f
2.38.1
Florian Festi 63a09f