libselinux: add library support for sockcreate

PATCH New Eric Paris 1 participant 1 message Aug 8, 2006 SELinux security module

Share & tools

Eric Paris

author

2006-08-08 18:53 UTC #0 lore raw

PATCH 1/1 libselinux: add library support for sockcreate

The below patch adds sockcreate support for libselinux by means of the 4 stamdard interfaces {get,set}sockcreatecon{,_raw}. This should complete the /proc/self/attr/sockcreate implementation which is already in the mainline kernel.

-Eric

 include/selinux/selinux.h |   11 +++++++++++
 src/getsockcreatecon.c    |   15 +++++++++++++++
 src/selinux.py            |    2 ++
 src/selinux_internal.h    |    2 ++
 src/selinuxswig.i         |    2 ++
 src/selinuxswig_wrap.c    |   46 ++++++++++++++++++++++++++++++++++++++++++++++
 src/setsockcreatecon.c    |   15 +++++++++++++++
 7 files changed, 93 insertions(+)

include/selinux/selinux.h +11 -0

diff -Naupr libselinux-1.30.22/include/selinux/selinux.h libselinux-1.30.22.sockcreate/include/selinux/selinux.h
@@ -82,6 +82,17 @@ extern "C" {
 	extern int setkeycreatecon(security_context_t context);
 	extern int setkeycreatecon_raw(security_context_t context);
 
+/* Get sockcreate context, and set *con to refer to it.
+   Sets *con to NULL if no socket create context has been set, i.e. using default.
+   If non-NULL, caller must free via freecon. */
+	extern int getsockcreatecon(security_context_t * con);
+	extern int getsockcreatecon_raw(security_context_t * con);
+
+/* Set the sockcreate security context for subsequent socket creations.
+   Call with NULL if you want to reset to the default. */
+	extern int setsockcreatecon(security_context_t context);
+	extern int setsockcreatecon_raw(security_context_t context);
+
 /* Wrappers for the xattr API. */
 
 /* Get file context, and set *con to refer to it.

src/getsockcreatecon.c +15 -0

diff -Naupr libselinux-1.30.22/src/getsockcreatecon.c libselinux-1.30.22.sockcreate/src/getsockcreatecon.c
@@ -0,0 +1,15 @@
+#include "selinux_internal.h"
+
+#define SOCKCREATE_PROC_ENTRY "/proc/self/attr/sockcreate"
+
+int getsockcreatecon_raw(security_context_t * context)
+{
+	return getprocattrcon_raw(context, SOCKCREATE_PROC_ENTRY);
+}
+
+hidden_def(getsockcreatecon_raw)
+
+int getsockcreatecon(security_context_t * context)
+{
+	return getprocattrcon(context, SOCKCREATE_PROC_ENTRY);
+}

src/selinux_internal.h +2 -0

diff -Naupr libselinux-1.30.22/src/selinux_internal.h libselinux-1.30.22.sockcreate/src/selinux_internal.h
@@ -45,8 +45,10 @@ hidden_proto(selinux_mkload_policy)
     hidden_proto(setexeccon_raw)
     hidden_proto(getfscreatecon_raw)
     hidden_proto(getkeycreatecon_raw)
+    hidden_proto(getsockcreatecon_raw)
     hidden_proto(setfscreatecon_raw)
     hidden_proto(setkeycreatecon_raw)
+    hidden_proto(setsockcreatecon_raw)
     hidden_proto(security_getenforce)
     hidden_proto(security_setenforce)
     hidden_proto(selinux_binary_policy_path)

src/selinux.py +2 -0

diff -Naupr libselinux-1.30.22/src/selinux.py libselinux-1.30.22.sockcreate/src/selinux.py
@@ -54,6 +54,8 @@ getfscreatecon = _selinux.getfscreatecon
 setfscreatecon = _selinux.setfscreatecon
 getkeycreatecon = _selinux.getkeycreatecon
 setkeycreatecon = _selinux.setkeycreatecon
+getsockcreatecon = _selinux.getsockcreatecon
+setsockcreatecon = _selinux.setsockcreatecon
 getfilecon = _selinux.getfilecon
 lgetfilecon = _selinux.lgetfilecon
 fgetfilecon = _selinux.fgetfilecon

src/selinuxswig.i +2 -0

diff -Naupr libselinux-1.30.22/src/selinuxswig.i libselinux-1.30.22.sockcreate/src/selinuxswig.i
@@ -54,6 +54,8 @@ extern int getfscreatecon(security_conte
 extern int setfscreatecon(security_context_t context);
 extern int getkeycreatecon(security_context_t *con);
 extern int setkeycreatecon(security_context_t context);
+extern int getsockcreatecon(security_context_t *con);
+extern int setsockcreatecon(security_context_t context);
 extern int getfilecon(const char *path, security_context_t *con);
 extern int lgetfilecon(const char *path, security_context_t *con);
 extern int fgetfilecon(int fd, security_context_t *con);

src/selinuxswig_wrap.c +46 -0

58 lines not on this page · raw message

src/setsockcreatecon.c +15 -0

diff -Naupr libselinux-1.30.22/src/setsockcreatecon.c libselinux-1.30.22.sockcreate/src/setsockcreatecon.c
@@ -0,0 +1,15 @@
+#include "selinux_internal.h"
+
+#define SOCKCREATE_PROC_ENTRY "/proc/self/attr/sockcreate"
+
+int setsockcreatecon_raw(security_context_t context)
+{
+	return setprocattrcon_raw(context, SOCKCREATE_PROC_ENTRY);
+}
+
+hidden_def(setsockcreatecon_raw)
+
+int setsockcreatecon(char *context)
+{
+	return setprocattrcon(context, SOCKCREATE_PROC_ENTRY);
+}

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.