To: vim-dev@vim.org

Subject: Patch 7.1.296

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.1.296

Problem:    SELinux is not supported.

Solution:   Detect the selinux library and use mch_copy_sec(). (James Vega)

Files:	    src/auto/configure, src/config.h.in, src/configure.in,

	    src/fileio.c, src/memfile.c, src/os_unix.c, src/proto/os_unix.pro

*** ../vim-7.1.295/src/auto/configure	Wed Feb 20 12:43:05 2008

--- src/auto/configure	Wed May  7 18:16:09 2008

***************

*** 845,850 ****

--- 845,851 ----

    --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)

    --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]

    --disable-darwin        Disable Darwin (Mac OS X) support.

+   --disable-selinux	  Don't check for SELinux support.

    --disable-xsmp          Disable XSMP session management

    --disable-xsmp-interact Disable XSMP interaction

    --enable-mzschemeinterp   Include MzScheme interpreter.

***************

*** 3611,3616 ****

--- 3612,3705 ----

  esac

  fi

+ echo "$as_me:$LINENO: checking --disable-selinux argument" >&5

+ echo $ECHO_N "checking --disable-selinux argument... $ECHO_C" >&6

+ # Check whether --enable-selinux or --disable-selinux was given.

+ if test "${enable_selinux+set}" = set; then

+   enableval="$enable_selinux"

+ 

+ else

+   enable_selinux="yes"

+ fi;

+ if test "$enable_selinux" = "yes"; then

+   echo "$as_me:$LINENO: result: no" >&5

+ echo "${ECHO_T}no" >&6

+   echo "$as_me:$LINENO: checking for is_selinux_enabled in -lselinux" >&5

+ echo $ECHO_N "checking for is_selinux_enabled in -lselinux... $ECHO_C" >&6

+ if test "${ac_cv_lib_selinux_is_selinux_enabled+set}" = set; then

+   echo $ECHO_N "(cached) $ECHO_C" >&6

+ else

+   ac_check_lib_save_LIBS=$LIBS

+ LIBS="-lselinux  $LIBS"

+ cat >conftest.$ac_ext <<_ACEOF

+ /* confdefs.h.  */

+ _ACEOF

+ cat confdefs.h >>conftest.$ac_ext

+ cat >>conftest.$ac_ext <<_ACEOF

+ /* end confdefs.h.  */

+ 

+ /* Override any gcc2 internal prototype to avoid an error.  */

+ #ifdef __cplusplus

+ extern "C"

+ #endif

+ /* We use char because int might match the return type of a gcc2

+    builtin and then its argument prototype would still apply.  */

+ char is_selinux_enabled ();

+ int

+ main ()

+ {

+ is_selinux_enabled ();

+   ;

+   return 0;

+ }

+ _ACEOF

+ rm -f conftest.$ac_objext conftest$ac_exeext

+ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5

+   (eval $ac_link) 2>conftest.er1

+   ac_status=$?

+   grep -v '^ *+' conftest.er1 >conftest.err

+   rm -f conftest.er1

+   cat conftest.err >&5

+   echo "$as_me:$LINENO: \$? = $ac_status" >&5

+   (exit $ac_status); } &&

+ 	 { ac_try='test -z "$ac_c_werror_flag"

+ 			 || test ! -s conftest.err'

+   { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

+   (eval $ac_try) 2>&5

+   ac_status=$?

+   echo "$as_me:$LINENO: \$? = $ac_status" >&5

+   (exit $ac_status); }; } &&

+ 	 { ac_try='test -s conftest$ac_exeext'

+   { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5

+   (eval $ac_try) 2>&5

+   ac_status=$?

+   echo "$as_me:$LINENO: \$? = $ac_status" >&5

+   (exit $ac_status); }; }; then

+   ac_cv_lib_selinux_is_selinux_enabled=yes

+ else

+   echo "$as_me: failed program was:" >&5

+ sed 's/^/| /' conftest.$ac_ext >&5

+ 

+ ac_cv_lib_selinux_is_selinux_enabled=no

+ fi

+ rm -f conftest.err conftest.$ac_objext \

+       conftest$ac_exeext conftest.$ac_ext

+ LIBS=$ac_check_lib_save_LIBS

+ fi

+ echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_is_selinux_enabled" >&5

+ echo "${ECHO_T}$ac_cv_lib_selinux_is_selinux_enabled" >&6

+ if test $ac_cv_lib_selinux_is_selinux_enabled = yes; then

+   LIBS="$LIBS -lselinux"

+ 	   cat >>confdefs.h <<\_ACEOF

+ #define HAVE_SELINUX 1

+ _ACEOF

+ 

+ fi

+ 

+ else

+    echo "$as_me:$LINENO: result: yes" >&5

+ echo "${ECHO_T}yes" >&6

+ fi

  echo "$as_me:$LINENO: checking --with-features argument" >&5

*** ../vim-7.1.295/src/config.h.in	Tue May  1 13:37:23 2007

--- src/config.h.in	Wed May  7 18:10:49 2008

***************

*** 156,161 ****

--- 156,162 ----

  #undef HAVE_READLINK

  #undef HAVE_RENAME

  #undef HAVE_SELECT

+ #undef HAVE_SELINUX

  #undef HAVE_SETENV

  #undef HAVE_SETPGID

  #undef HAVE_SETSID

*** ../vim-7.1.295/src/configure.in	Wed Feb 20 12:43:05 2008

--- src/configure.in	Wed May  7 18:15:40 2008

***************

*** 299,304 ****

--- 299,317 ----

  esac

  fi

+ dnl Link with -lselinux for SELinux stuff; if not found

+ AC_MSG_CHECKING(--disable-selinux argument)

+ AC_ARG_ENABLE(selinux,

+ 	[  --disable-selinux	  Don't check for SELinux support.],

+ 	, enable_selinux="yes")

+ if test "$enable_selinux" = "yes"; then

+   AC_MSG_RESULT(no)

+   AC_CHECK_LIB(selinux, is_selinux_enabled,

+ 	  [LIBS="$LIBS -lselinux"

+ 	   AC_DEFINE(HAVE_SELINUX)])

+ else

+    AC_MSG_RESULT(yes)

+ fi

  dnl Check user requested features.

*** ../vim-7.1.295/src/fileio.c	Tue Mar 11 22:01:16 2008

--- src/fileio.c	Wed May  7 18:17:45 2008

***************

*** 3651,3656 ****

--- 3660,3668 ----

  						)

  			    mch_setperm(backup,

  					  (perm & 0707) | ((perm & 07) << 3));

+ # ifdef HAVE_SELINUX

+ 			mch_copy_sec(fname, backup);

+ # endif

  #endif

  			/*

***************

*** 3687,3692 ****

--- 3699,3707 ----

  #ifdef HAVE_ACL

  			mch_set_acl(backup, acl);

  #endif

+ #ifdef HAVE_SELINUX

+ 			mch_copy_sec(fname, backup);

+ #endif

  			break;

  		    }

  		}

***************

*** 4309,4314 ****

--- 4324,4335 ----

      }

  #endif

+ #ifdef HAVE_SELINUX

+     /* Probably need to set the security context. */

+     if (!backup_copy)

+ 	mch_copy_sec(backup, wfname);

+ #endif

+ 

  #ifdef UNIX

      /* When creating a new file, set its owner/group to that of the original

       * file.  Get the new device and inode number. */

*** ../vim-7.1.295/src/memfile.c	Fri May 11 20:15:45 2007

--- src/memfile.c	Wed May  7 18:10:49 2008

***************

*** 1346,1350 ****

--- 1346,1355 ----

  	mfp->mf_ffname = NULL;

      }

      else

+     {

+ #ifdef HAVE_SELINUX

+ 	mch_copy_sec(fname, mfp->mf_fname);

+ #endif

  	mch_hide(mfp->mf_fname);    /* try setting the 'hidden' flag */

+     }

  }

*** ../vim-7.1.295/src/os_unix.c	Wed Mar 12 13:16:37 2008

--- src/os_unix.c	Wed May  7 18:24:46 2008

***************

*** 45,50 ****

--- 45,55 ----

  # include <X11/SM/SMlib.h>

  #endif

+ #ifdef HAVE_SELINUX

+ # include <selinux/selinux.h>

+ static int selinux_enabled = -1;

+ #endif

+ 

  /*

   * Use this prototype for select, some include files have a wrong prototype

   */

***************

*** 2557,2562 ****

--- 2562,2623 ----

  } vim_acl_solaris_T;

  # endif

+ #if defined(HAVE_SELINUX) || defined(PROTO)

+ /*

+  * Copy security info from "from_file" to "to_file".

+  */

+     void

+ mch_copy_sec(from_file, to_file)

+     char_u	*from_file;

+     char_u	*to_file;

+ {

+     if (from_file == NULL)

+ 	return;

+ 

+     if (selinux_enabled == -1)

+ 	selinux_enabled = is_selinux_enabled();

+ 

+     if (selinux_enabled > 0)

+     {

+ 	security_context_t from_context = NULL;

+ 	security_context_t to_context = NULL;

+ 

+ 	if (getfilecon((char *)from_file, &from_context) < 0)

+ 	{

+ 	    /* If the filesystem doesn't support extended attributes,

+ 	       the original had no special security context and the

+ 	       target cannot have one either.  */

+ 	    if (errno == EOPNOTSUPP)

+ 		return;

+ 

+ 	    MSG_PUTS(_("\nCould not get security context for "));

+ 	    msg_outtrans(from_file);

+ 	    msg_putchar('\n');

+ 	    return;

+ 	}

+ 	if (getfilecon((char *)to_file, &to_context) < 0)

+ 	{

+ 	    MSG_PUTS(_("\nCould not get security context for "));

+ 	    msg_outtrans(to_file);

+ 	    msg_putchar('\n');

+ 	    freecon (from_context);

+ 	    return ;

+ 	}

+ 	if (strcmp(from_context, to_context) != 0)

+ 	{

+ 	    if (setfilecon((char *)to_file, from_context) < 0)

+ 	    {

+ 		MSG_PUTS(_("\nCould not set security context for "));

+ 		msg_outtrans(to_file);

+ 		msg_putchar('\n');

+ 	    }

+ 	}

+ 	freecon(to_context);

+ 	freecon(from_context);

+     }

+ }

+ #endif /* HAVE_SELINUX */

+ 

  /*

   * Return a pointer to the ACL of file "fname" in allocated memory.

   * Return NULL if the ACL is not available for whatever reason.

*** ../vim-7.1.295/src/proto/os_unix.pro	Sat May  5 20:23:37 2007

--- src/proto/os_unix.pro	Wed May  7 18:25:14 2008

***************

*** 34,39 ****

--- 34,40 ----

  void fname_case __ARGS((char_u *name, int len));

  long mch_getperm __ARGS((char_u *name));

  int mch_setperm __ARGS((char_u *name, long perm));

+ void mch_copy_sec __ARGS((char_u *from_file, char_u *to_file));

  vim_acl_T mch_get_acl __ARGS((char_u *fname));

  void mch_set_acl __ARGS((char_u *fname, vim_acl_T aclent));

  void mch_free_acl __ARGS((vim_acl_T aclent));

*** ../vim-7.1.295/src/version.c	Wed May  7 17:39:17 2008

--- src/version.c	Wed May  7 18:50:01 2008

***************

*** 668,669 ****

--- 673,676 ----

  {   /* Add new patch number below this line */

+ /**/

+     296,

  /**/

-- 

Michael: There is no such thing as a dump question.

Bernard: Sure there is.  For example "what is a core dump?"

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///