From 29add823913b66e0637d27d962ad5c5f9c85de70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Mon, 28 Jan 2019 12:13:54 +0100
Subject: [PATCH] lib: make selinux functions work with selinux disabled
Resolves:
https://github.com/pbrezina/authselect/issues/133
---
src/lib/util/file.c | 38 +++++++++++++++++++++++++++++++++
src/lib/util/file.h | 13 +++++++++++-
src/lib/util/selinux.c | 47 ++++++++++++++++-------------------------
src/lib/util/selinux.h | 8 ++++---
src/lib/util/template.c | 23 ++++++--------------
5 files changed, 79 insertions(+), 50 deletions(-)
diff --git a/src/lib/util/file.c b/src/lib/util/file.c
index fa231f771a7d0cdd449b69c4bf7b00d93aefc375..2e23ce39ec04e6aaf79f16410f9ac08dc3f9d54c 100644
--- a/src/lib/util/file.c
+++ b/src/lib/util/file.c
@@ -329,3 +329,41 @@ file_make_path(const char *path, mode_t mode)
return EOK;
}
+
+errno_t
+file_mktmp_for(const char *path, mode_t mode, char **_tmpfile)
+{
+ mode_t oldmask;
+ char *tmpfile;
+ errno_t ret;
+ int fd;
+
+ oldmask = umask(mode);
+
+ tmpfile = format("%s.XXXXXX", path);
+ if (tmpfile == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ fd = mkstemp(tmpfile);
+ if (fd == -1) {
+ ret = errno;
+ goto done;
+ }
+
+ close(fd);
+
+ *_tmpfile = tmpfile;
+
+ ret = EOK;
+
+done:
+ if (ret != EOK) {
+ free(tmpfile);
+ }
+
+ umask(oldmask);
+
+ return ret;
+}
diff --git a/src/lib/util/file.h b/src/lib/util/file.h
index 49ebef37443bf137439bad27fd75283c25c9c3e5..6d5823791bfcc581304200d0c2d37b41c3d7b95d 100644
--- a/src/lib/util/file.h
+++ b/src/lib/util/file.h
@@ -133,7 +133,7 @@ file_get_parent_directory(const char *filepath);
/**
* Create all directories in a path. Path must end with a directory not a file.
*
- * @param filename Path to the file whose directories should be created.
+ * @param path Path to the file whose directories should be created.
* @param mode Directory mode.
*
* @return EOK on success, other errno code on error.
@@ -141,4 +141,15 @@ file_get_parent_directory(const char *filepath);
errno_t
file_make_path(const char *path, mode_t mode);
+/**
+ * Make temporary file for @path so it can be first written and then safelly
+ * renamed to @path.
+ *
+ * @param path Path to the file whose directories should be created.
+ * @param mode Temporary file mode.
+ * @param _tmpfile Path to created temporary file.
+ */
+errno_t
+file_mktmp_for(const char *path, mode_t mode, char **_tmpfile);
+
#endif /* _FILE_H_ */
diff --git a/src/lib/util/selinux.c b/src/lib/util/selinux.c
index 9b0e0ff26b768d88f67a42985c5d5bafb8aa58ec..01b68087b265c0ef1c1087f626df8e20de086338 100644
--- a/src/lib/util/selinux.c
+++ b/src/lib/util/selinux.c
@@ -26,6 +26,7 @@
#include <selinux/label.h>
#include "common/common.h"
+#include "lib/util/file.h"
errno_t
selinux_get_default_context(const char *path,
@@ -61,15 +62,19 @@ selinux_get_default_context(const char *path,
}
errno_t
-selinux_mkstemp_of(const char *filepath,
- char **_tmpfile)
+selinux_mkstemp_for(const char *filepath,
+ mode_t mode,
+ char **_tmpfile)
{
char *original_context = NULL;
char *default_context = NULL;
- char *tmpfile = NULL;
+ char *tmpfile;
errno_t ret;
int seret;
- int fd;
+
+ if (is_selinux_enabled() != 1) {
+ return file_mktmp_for(filepath, mode, _tmpfile);
+ }
seret = getfscreatecon(&original_context);
if (seret != 0) {
@@ -77,12 +82,6 @@ selinux_mkstemp_of(const char *filepath,
return EIO;
}
- tmpfile = format("%s.XXXXXX", filepath);
- if (tmpfile == NULL) {
- ret = ENOMEM;
- goto done;
- }
-
ret = selinux_get_default_context(filepath, &default_context);
if (ret == ENOENT) {
default_context = NULL;
@@ -92,6 +91,7 @@ selinux_mkstemp_of(const char *filepath,
goto done;
}
+ /* Set desired fs create context. */
seret = setfscreatecon(default_context);
if (seret != 0) {
ERROR("Unable to set fscreate selinux context!");
@@ -99,22 +99,9 @@ selinux_mkstemp_of(const char *filepath,
goto done;
}
- fd = mkstemp(tmpfile);
- if (fd == -1) {
- ret = errno;
-
- seret = setfscreatecon(original_context);
- if (seret != 0) {
- ERROR("Unable to restore fscreate selinux context!");
- ret = EIO;
- goto done;
- }
-
- goto done;
- }
-
- close(fd);
+ ret = file_mktmp_for(filepath, mode, &tmpfile);
+ /* Restore original fs create context. */
seret = setfscreatecon(original_context);
if (seret != 0) {
ERROR("Unable to restore fscreate selinux context!");
@@ -122,6 +109,12 @@ selinux_mkstemp_of(const char *filepath,
goto done;
}
+ /* Check result of file_mktmp_for() */
+ if (ret != EOK) {
+ free(tmpfile);
+ goto done;
+ }
+
*_tmpfile = tmpfile;
ret = EOK;
@@ -135,9 +128,5 @@ done:
freecon(default_context);
}
- if (ret != EOK) {
- free(tmpfile);
- }
-
return ret;
}
diff --git a/src/lib/util/selinux.h b/src/lib/util/selinux.h
index 26f2374140562dd085145845ed3092a0ddcf924e..8abfb3fb5d244b32570cc9e573b2e12df14177e1 100644
--- a/src/lib/util/selinux.h
+++ b/src/lib/util/selinux.h
@@ -39,12 +39,14 @@ selinux_get_default_context(const char *path);
* set to default security context of @filepath.
*
* @param filepath File for which a temporary file should be created.
- * @param _tmpfile Create temporary file.
+ * @param mode Temporary file mode.
+ * @param _tmpfile Created temporary file.
*
* @return EOK on success, other errno code on failure.
*/
errno_t
-selinux_mkstemp_of(const char *filepath,
- char **_tmpfile);
+selinux_mkstemp_for(const char *filepath,
+ mode_t mode,
+ char **_tmpfile);
#endif /* _SELINUX_H_ */
diff --git a/src/lib/util/template.c b/src/lib/util/template.c
index 9773dcbf1ecbde4fe2408f1b816dce129747806f..1f3464912d8fe7afe8a7f0920fe31eb5c2dfaba5 100644
--- a/src/lib/util/template.c
+++ b/src/lib/util/template.c
@@ -592,36 +592,25 @@ template_write_temporary(const char *filepath,
mode_t mode,
char **_tmpfile)
{
- mode_t oldmask;
char *tmpfile;
errno_t ret;
- oldmask = umask(mode);
-
- ret = selinux_mkstemp_of(filepath, &tmpfile);
+ ret = selinux_mkstemp_for(filepath, mode, &tmpfile);
if (ret != EOK) {
ERROR("Unable to create temporary file for [%s] [%d]: %s",
filepath, ret, strerror(ret));
- goto done;
+ return ret;
}
ret = template_write(tmpfile, content, mode);
- if (ret != EOK) {
- goto done;
- }
-
- *_tmpfile = tmpfile;
-
- ret = EOK;
-
-done:
- umask(oldmask);
-
if (ret != EOK) {
free(tmpfile);
+ return ret;
}
- return ret;
+ *_tmpfile = tmpfile;
+
+ return EOK;
}
bool
--
2.17.2