|
 |
587979 |
From d10e773c014a12b17fefd9caef0bd02528d75d18 Mon Sep 17 00:00:00 2001
|
|
|
587979 |
From: Antoine Tenart <antoine.tenart@bootlin.com>
|
|
|
587979 |
Date: Tue, 7 Jul 2020 16:35:01 +0200
|
|
|
587979 |
Subject: [PATCH] policycoreutils: setfiles: do not restrict checks against a
|
|
|
587979 |
binary policy
|
|
|
587979 |
|
|
|
587979 |
The -c option allows to check the validity of contexts against a
|
|
|
587979 |
specified binary policy. Its use is restricted: no pathname can be used
|
|
|
587979 |
when a binary policy is given to setfiles. It's not clear if this is
|
|
|
587979 |
intentional as the built-in help and the man page are not stating the
|
|
|
587979 |
same thing about this (the man page document -c as a normal option,
|
|
|
587979 |
while the built-in help shows it is restricted).
|
|
|
587979 |
|
|
|
587979 |
When generating full system images later used with SELinux in enforcing
|
|
|
587979 |
mode, the extended attributed of files have to be set by the build
|
|
|
587979 |
machine. The issue is setfiles always checks the contexts against a
|
|
|
587979 |
policy (ctx_validate = 1) and using an external binary policy is not
|
|
|
587979 |
currently possible when using a pathname. This ends up in setfiles
|
|
|
587979 |
failing early as the contexts of the target image are not always
|
|
|
587979 |
compatible with the ones of the build machine.
|
|
|
587979 |
|
|
|
587979 |
This patch reworks a check on optind only made when -c is used, that
|
|
|
587979 |
enforced the use of a single argument to allow 1+ arguments, allowing to
|
|
|
587979 |
use setfiles with an external binary policy and pathnames. The following
|
|
|
587979 |
command is then allowed, as already documented in the man page:
|
|
|
587979 |
|
|
|
587979 |
$ setfiles -m -r target/ -c policy.32 file_contexts target/
|
|
|
587979 |
|
|
|
587979 |
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
|
|
|
587979 |
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
|
|
|
587979 |
|
|
|
587979 |
(cherry-picked from SElinuxProject
|
|
|
587979 |
commit: c94e542c98da2f26863c1cbd9d7ad9bc5cca6aff )
|
|
|
587979 |
---
|
|
|
587979 |
policycoreutils/setfiles/setfiles.c | 11 +++++------
|
|
|
587979 |
1 file changed, 5 insertions(+), 6 deletions(-)
|
|
|
587979 |
|
|
|
587979 |
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
|
|
587979 |
index 82d0aaa7..4fd3d756 100644
|
|
|
587979 |
--- a/policycoreutils/setfiles/setfiles.c
|
|
|
587979 |
+++ b/policycoreutils/setfiles/setfiles.c
|
|
|
587979 |
@@ -39,11 +39,10 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
|
|
587979 |
name, name);
|
|
|
587979 |
} else {
|
|
|
587979 |
fprintf(stderr,
|
|
|
587979 |
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n"
|
|
|
587979 |
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n"
|
|
|
587979 |
- "usage: %s -s [-diIDlmnpqvFW] spec_file\n"
|
|
|
587979 |
- "usage: %s -c policyfile spec_file\n",
|
|
|
587979 |
- name, name, name, name);
|
|
|
587979 |
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
|
|
|
587979 |
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
|
|
|
587979 |
+ "usage: %s -s [-diIDlmnpqvFW] spec_file\n",
|
|
|
587979 |
+ name, name, name);
|
|
|
587979 |
}
|
|
|
587979 |
exit(-1);
|
|
|
587979 |
}
|
|
|
587979 |
@@ -376,7 +375,7 @@ int main(int argc, char **argv)
|
|
|
587979 |
|
|
|
587979 |
if (!iamrestorecon) {
|
|
|
587979 |
if (policyfile) {
|
|
|
587979 |
- if (optind != (argc - 1))
|
|
|
587979 |
+ if (optind > (argc - 1))
|
|
|
587979 |
usage(argv[0]);
|
|
|
587979 |
} else if (use_input_file) {
|
|
|
587979 |
if (optind != (argc - 1)) {
|
|
|
587979 |
--
|
|
|
587979 |
2.30.2
|
|
|
587979 |
|