From f71db1f834f639a16a38e7314ba7ca0dd0d060d8 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 17 Feb 2014 16:52:52 +0100
Subject: [PATCH] core: store and expose SELinuxContext field normalized as
bool + string
Conflicts:
src/core/dbus-execute.c
src/core/execute.c
src/core/load-fragment.h
(cherry picked from commit 5f8640fb628cb034981e02d741fd9ddf26fdf38d)
Related: #1113790
---
src/core/dbus-execute.c | 26 ++++++++++++++++++-
src/core/execute.c | 18 +++----------
src/core/execute.h | 1 +
src/core/load-fragment-gperf.gperf.m4 | 2 +-
src/core/load-fragment.c | 48 +++++++++++++++++++++++++++++++++++
src/core/load-fragment.h | 1 +
6 files changed, 80 insertions(+), 16 deletions(-)
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 97d75fa..8162f1c 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -372,6 +372,30 @@ static int bus_execute_append_syscall_filter(DBusMessageIter *i, const char *pro
return 0;
}
+static int bus_execute_append_selinux_context(DBusMessageIter *i, const char *property, void *data) {
+ ExecContext *c = data;
+ dbus_bool_t selinux_context_ignore;
+ const char *selinux_context = NULL;
+
+ assert(i);
+ assert(property);
+ assert(c);
+
+ selinux_context = c->selinux_context;
+ if (!selinux_context)
+ selinux_context = "";
+
+ selinux_context_ignore = c->selinux_context_ignore;
+
+ if (!dbus_message_iter_append_basic(i, DBUS_TYPE_BOOLEAN, &selinux_context_ignore))
+ return -ENOMEM;
+
+ if (!dbus_message_iter_append_basic(i, DBUS_TYPE_STRING, &selinux_context))
+ return -ENOMEM;
+
+ return 0;
+}
+
const BusProperty bus_exec_context_properties[] = {
{ "Environment", bus_property_append_strv, "as", offsetof(ExecContext, environment), true },
{ "EnvironmentFiles", bus_execute_append_env_files, "a(sb)", offsetof(ExecContext, environment_files), true },
@@ -429,7 +453,7 @@ const BusProperty bus_exec_context_properties[] = {
{ "PrivateNetwork", bus_property_append_bool, "b", offsetof(ExecContext, private_network) },
{ "SameProcessGroup", bus_property_append_bool, "b", offsetof(ExecContext, same_pgrp) },
{ "UtmpIdentifier", bus_property_append_string, "s", offsetof(ExecContext, utmp_id), true },
- { "SELinuxContext", bus_property_append_string, "s", offsetof(ExecContext, selinux_context), true },
+ { "SELinuxContext", bus_execute_append_selinux_context, "(bs)", 0 },
{ "IgnoreSIGPIPE", bus_property_append_bool, "b", offsetof(ExecContext, ignore_sigpipe) },
{ "NoNewPrivileges", bus_property_append_bool, "b", offsetof(ExecContext, no_new_privileges) },
{ "SystemCallFilter", bus_execute_append_syscall_filter, "au", 0 },
diff --git a/src/core/execute.c b/src/core/execute.c
index 9fc5090..a20301d 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1474,18 +1474,8 @@ int exec_spawn(ExecCommand *command,
}
#ifdef HAVE_SELINUX
if (context->selinux_context && use_selinux()) {
- bool ignore;
- char* c;
-
- c = context->selinux_context;
- if (c[0] == '-') {
- c++;
- ignore = true;
- } else
- ignore = false;
-
- err = setexeccon(c);
- if (err < 0 && !ignore) {
+ err = setexeccon(context->selinux_context);
+ if (err < 0 && !context->selinux_context_ignore) {
r = EXIT_SELINUX_CONTEXT;
goto fail_child;
}
@@ -2097,8 +2087,8 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
if (c->selinux_context)
fprintf(f,
- "%sSELinuxContext: %s\n",
- prefix, c->selinux_context);
+ "%sSELinuxContext: %s%s\n",
+ prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
}
diff --git a/src/core/execute.h b/src/core/execute.h
index 92ac8dd..2452126 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -124,6 +124,7 @@ struct ExecContext {
char *utmp_id;
+ bool selinux_context_ignore;
char *selinux_context;
char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;
diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4
index 935f04e..759fbd8 100644
--- a/src/core/load-fragment-gperf.gperf.m4
+++ b/src/core/load-fragment-gperf.gperf.m4
@@ -76,7 +76,7 @@ $1.TCPWrapName, config_parse_unit_string_printf, 0,
$1.PAMName, config_parse_unit_string_printf, 0, offsetof($1, exec_context.pam_name)
$1.IgnoreSIGPIPE, config_parse_bool, 0, offsetof($1, exec_context.ignore_sigpipe)
$1.UtmpIdentifier, config_parse_unit_string_printf, 0, offsetof($1, exec_context.utmp_id)
-$1.SELinuxContext, config_parse_unit_string_printf, 0, offsetof($1, exec_context.selinux_context)'
+$1.SELinuxContext, config_parse_exec_selinux_context, 0, offsetof($1, exec_context)'
)m4_dnl
m4_define(`KILL_CONTEXT_CONFIG_ITEMS',
`$1.SendSIGKILL, config_parse_bool, 0, offsetof($1, kill_context.send_sigkill)
diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index f01843d..8e6e428 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -1139,6 +1139,54 @@ int config_parse_exec_mount_flags(const char *unit,
return 0;
}
+int config_parse_exec_selinux_context(
+ const char *unit,
+ const char *filename,
+ unsigned line,
+ const char *section,
+ const char *lvalue,
+ int ltype,
+ const char *rvalue,
+ void *data,
+ void *userdata) {
+
+ ExecContext *c = data;
+ Unit *u = userdata;
+ bool ignore;
+ char *k;
+ int r;
+
+ assert(filename);
+ assert(lvalue);
+ assert(rvalue);
+ assert(data);
+
+ if (isempty(rvalue)) {
+ free(c->selinux_context);
+ c->selinux_context = NULL;
+ c->selinux_context_ignore = false;
+ return 0;
+ }
+
+ if (rvalue[0] == '-') {
+ ignore = true;
+ rvalue++;
+ } else
+ ignore = false;
+
+ r = unit_name_printf(u, rvalue, &k);
+ if (r < 0) {
+ log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve specifiers, ignoring: %s", strerror(-r));
+ return 0;
+ }
+
+ free(c->selinux_context);
+ c->selinux_context = k;
+ c->selinux_context_ignore = ignore;
+
+ return 0;
+}
+
int config_parse_timer(const char *unit,
const char *filename,
unsigned line,
diff --git a/src/core/load-fragment.h b/src/core/load-fragment.h
index 90e5e3a..de48436 100644
--- a/src/core/load-fragment.h
+++ b/src/core/load-fragment.h
@@ -83,6 +83,7 @@ int config_parse_device_allow(const char *unit, const char *filename, unsigned l
int config_parse_blockio_weight(const char *unit, const char *filename, unsigned line, const char *section, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
int config_parse_blockio_device_weight(const char *unit, const char *filename, unsigned line, const char *section, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
int config_parse_blockio_bandwidth(const char *unit, const char *filename, unsigned line, const char *section, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
+int config_parse_exec_selinux_context(const char *unit, const char *filename, unsigned line, const char *section, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
/* gperf prototypes */
const struct ConfigPerfItem* load_fragment_gperf_lookup(const char *key, unsigned length);