libselinux: do not check fcontext duplicates on use
PATCH 6/155 libselinux: do not check fcontext duplicates on use
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch looks good to me. acked.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk45tB4ACgkQrlYvE4MpobNbVwCgpzlYBRsKdMJ2+MTRcR/JTEt4 VmIAoJjd8nTHf9WyoIJDrs61wl5XaWkM
=MfbT
-----END PGP SIGNATURE-----
Quoted 7 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1This patch looks good to me. acked.
From
576af10294e14d03660708d3f7eddf49e71897d7Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Tue, 28 Jun 2011 21:37:38 -0400
Subject: [PATCH 006/155] libselinux: do not check fcontext duplicates on use
Tools like restorecon or systemd, which load the fcontext database to make labeling decisions do not need to check for duplicate rules. Only the first rule will be used. Instead we should only check for duplicates when new rules are added to the database. And fail the transaction if we find one.
--- libselinux/src/label_file.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
libselinux/src/label_file.c +1 -1
@@ -485,7 +485,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts, pass, ++lineno) != 0) goto finish; } -if (pass ==1 ) { +if (pass ==1 && rec->validating) { status =nodups_specs (data, path);if (status) goto finish;
This seems like the wrong fix to me. rec->validating is set based on whether the application passed SELABEL_OPT_VALIDATE in the selinux_opt array to selabel_open(). So you should fix the applications that set this option if you do not want this behavior. Not silently ignore what they requested while leaving the field and option flag intact.
Signature · 2 lines
Stephen Smalley National Security Agency
Quoted 1 line
From
576af10294e14d03660708d3f7eddf49e71897d7Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Tue, 28 Jun 2011 21:37:38 -0400
Subject: [PATCH 006/155] libselinux: do not check fcontext duplicates on use
Tools like restorecon or systemd, which load the fcontext database to make labeling decisions do not need to check for duplicate rules. Only the first rule will be used. Instead we should only check for duplicates when new rules are added to the database. And fail the transaction if we find one.
--- libselinux/src/label_file.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
libselinux/src/label_file.c +1 -1
@@ -485,7 +485,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts, pass, ++lineno) != 0) goto finish; } -if (pass ==1 ) { +if (pass ==1 && rec->validating) { status =nodups_specs (data, path);if (status) goto finish;
Signature · 1 line
1.7.6
Quoted 38 lines · Stephen Smalley
Quoted 7 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1This patch looks good to me. acked.
From
576af10294e14d03660708d3f7eddf49e71897d7Mon Sep 17 00:00:00 2001From: Eric Paris <[email protected]>
Date: Tue, 28 Jun 2011 21:37:38 -0400
Subject: [PATCH 006/155] libselinux: do not check fcontext duplicates on useTools like restorecon or systemd, which load the fcontext database to make labeling decisions do not need to check for duplicate rules. Only the first rule will be used. Instead we should only check for duplicates when new rules are added to the database. And fail the transaction if we find one.
Signed-off-by Eric Paris <[email protected]>--- libselinux/src/label_file.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)libselinux/src/label_file.c +1
-1@@ -485,7 +485,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts, pass, ++lineno) != 0) goto finish; } -if (pass ==1 ) { +if (pass ==1 && rec->validating) { status =nodups_specs (data, path);if (status) goto finish;
Quoted 5 lines
This seems like the wrong fix to me.
rec->validatingis set based on whether the application passedSELABEL_OPT_VALIDATEin theselinux_optarray toselabel_open(). So you should fix the applications that set this option if you do not want this behavior. Not silently ignore what they requested while leaving the field and option flag intact.
I don't understand. Before this patch rec->validating wasn't being used at all and we always checked for dups. With this patch we actually pay attention to what the application set. As it turns out restorecon/fixfiles don't set the flag, but semanage fcontext does, so this is actually a case where the programs were right but the underlying library was wrong. I'm fixing the library to pay attention to the flag.
What am I missing?
-Eric
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 7 lines · Eric Paris
I don't understand. Before this patch
rec->validatingwasn't being used at all and we always checked for dups. With this patch we actually pay attention to what the application set. As it turns out restorecon/fixfiles don't set the flag, but semanage fcontext does, so this is actually a case where the programs were right but the underlying library was wrong. I'm fixing the library to pay attention to the flag.
What am I missing?
Oops, I read the patch backwards. Never mind.
Technically the library was correct in that the original meaning of validate was to validate the contexts, but I suppose this fits with the sense of it.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.