Skip to contentSkip to conversation

libselinux: renamed andriod label backend source file

PATCH Applied Janis Danisevskis 3 participants 6 messages Sep 29, 2016 SELinux security module

lore
Share & tools
lore

Janis Danisevskis

author
#0 lore raw

PATCH 1/3 libselinux: renamed andriod label backend source file

Signed-off-by Janis Danisevskis <[email protected]>
---
 libselinux/src/Makefile                 |   2 +-
 libselinux/src/label_android_property.c | 304 --------------------------------
 libselinux/src/label_backends_android.c | 304 ++++++++++++++++++++++++++++++++
 3 files changed, 305 insertions(+), 305 deletions(-)
 delete mode 100644 libselinux/src/label_android_property.c
 create mode 100644 libselinux/src/label_backends_android.c
libselinux/src/Makefile +1 -1
index 2c61fad..cba8383 100644
@@ -85,7 +85,7 @@ ifeq ($(ANDROID_HOST),y)
 DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
 	-DBUILD_HOST
 SRCS= callbacks.c freecon.c label.c label_file.c \
-	label_android_property.c regex.c label_support.c \
+	label_backends_android.c regex.c label_support.c \
 	matchpathcon.c setrans_client.c sha1.c
 endif
libselinux/src/label_android_property.c deleted +0 -304

304 lines not on this page · raw message

libselinux/src/label_backends_android.c new file +304 -0

304 lines not on this page · raw message

Signature · 1 line
1.9.1
author
#1 lore raw

PATCH 2/3 libselinux: android: fix lax service context lookup

We use the same lookup function for service contexts that we use for property contexts. However, property contexts are namespace based and only compare the prefix. This may lead to service associations with a wrong label.

This patch introduces a new back end for android services with a stricter lookup function. Now the service name must match the key of the service label exactly.

Signed-off-by Janis Danisevskis <[email protected]>
---
 libselinux/include/selinux/label.h      |  2 ++
 libselinux/src/label.c                  |  1 +
 libselinux/src/label_backends_android.c | 54 +++++++++++++++++++++++++++++++--
 libselinux/src/label_internal.h         |  3 ++
 libselinux/utils/selabel_digest.c       |  2 ++
 libselinux/utils/selabel_lookup.c       |  2 ++
 6 files changed, 62 insertions(+), 2 deletions(-)
libselinux/include/selinux/label.h +2 -0
index f0b1e10..277287e 100644
@@ -34,6 +34,8 @@ struct selabel_handle;
 #define SELABEL_CTX_DB		3
 /* Android property service contexts */
 #define SELABEL_CTX_ANDROID_PROP 4
+/* Android service contexts */
+#define SELABEL_CTX_ANDROID_SERVICE 5
 
 /*
  * Available options
libselinux/src/label.c +1 -0
index 96a4ff1..eb0e766 100644
@@ -45,6 +45,7 @@ static selabel_initfunc initfuncs[] = {
 	CONFIG_X_BACKEND(selabel_x_init),
 	CONFIG_DB_BACKEND(selabel_db_init),
 	&selabel_property_init,
+	&selabel_service_init,
 };
 
 static void selabel_subs_fini(struct selabel_sub *ptr)
libselinux/src/label_backends_android.c +52 -2

72 lines not on this page · raw message

libselinux/src/label_internal.h +3 -0
index 7c55531..6a9481a 100644
@@ -39,6 +39,9 @@ int selabel_db_init(struct selabel_handle *rec,
 int selabel_property_init(struct selabel_handle *rec,
 			    const struct selinux_opt *opts,
 			    unsigned nopts) hidden;
+int selabel_service_init(struct selabel_handle *rec,
+			    const struct selinux_opt *opts,
+			    unsigned nopts) hidden;
 
 /*
  * Labeling internal structures
libselinux/utils/selabel_digest.c +2 -0
index 38162a5..e4d84a5 100644
@@ -92,6 +92,8 @@ int main(int argc, char **argv)
 				backend = SELABEL_CTX_DB;
 			} else if (!strcmp(optarg, "prop")) {
 				backend = SELABEL_CTX_ANDROID_PROP;
+			} else if (!strcmp(optarg, "service")) {
+				backend = SELABEL_CTX_ANDROID_SERVICE;
 			} else {
 				fprintf(stderr, "Unknown backend: %s\n",
 								    optarg);
libselinux/utils/selabel_lookup.c +2 -0
index d0b1457..b678a89 100644
@@ -57,6 +57,8 @@ int main(int argc, char **argv)
 				backend = SELABEL_CTX_DB;
 			} else if (!strcmp(optarg, "prop")) {
 				backend = SELABEL_CTX_ANDROID_PROP;
+			} else if (!strcmp(optarg, "service")) {
+				backend = SELABEL_CTX_ANDROID_SERVICE;
 			} else {
 				fprintf(stderr, "Unknown backend: %s\n",
 								    optarg);
Signature · 1 line
1.9.1
#2 lore raw

Re: [PATCH 2/3] libselinux: android: fix lax service context lookup

do you have the corresponding changes to checkfc on AOSP?

Quoted 173 lines · Janis Danisevskis

We use the same lookup function for service contexts that we use for property contexts. However, property contexts are namespace based and only compare the prefix. This may lead to service associations with a wrong label.

This patch introduces a new back end for android services with a stricter lookup function. Now the service name must match the key of the service label exactly.

Signed-off-by Janis Danisevskis <[email protected]>
---
 libselinux/include/selinux/label.h      |  2 ++
 libselinux/src/label.c                  |  1 +
 libselinux/src/label_backends_android.c | 54 +++++++++++++++++++++++++++++++--
 libselinux/src/label_internal.h         |  3 ++
 libselinux/utils/selabel_digest.c       |  2 ++
 libselinux/utils/selabel_lookup.c       |  2 ++
 6 files changed, 62 insertions(+), 2 deletions(-)
libselinux/include/selinux/label.h +2 -0
index f0b1e10..277287e 100644
@@ -34,6 +34,8 @@ struct selabel_handle;
 #define SELABEL_CTX_DB         3
 /* Android property service contexts */
 #define SELABEL_CTX_ANDROID_PROP 4
+/* Android service contexts */
+#define SELABEL_CTX_ANDROID_SERVICE 5
 
 /*
  * Available options
libselinux/src/label.c +1 -0
index 96a4ff1..eb0e766 100644
@@ -45,6 +45,7 @@ static selabel_initfunc initfuncs[] = {
        CONFIG_X_BACKEND(selabel_x_init),
        CONFIG_DB_BACKEND(selabel_db_init),
        &selabel_property_init,
+       &selabel_service_init,
 };
 
 static void selabel_subs_fini(struct selabel_sub *ptr)
libselinux/src/label_backends_android.c +52 -2
index 290b438..4d6ec86 100644
@@ -244,7 +244,7 @@ static void closef(struct selabel_handle *rec)
        free(data);
 }
 
-static struct selabel_lookup_rec *lookup(struct selabel_handle *rec,
+static struct selabel_lookup_rec *property_lookup(struct selabel_handle *rec,
                                         const char *key,
                                         int __attribute__((unused)) type)
 {

@@ -279,6 +279,38 @@ finish:
        return ret;
 }
 
+static struct selabel_lookup_rec *service_lookup(struct selabel_handle *rec,
+               const char *key, int __attribute__((unused)) type)
+{
+       struct saved_data *data = (struct saved_data *)rec->data;
+       spec_t *spec_arr = data->spec_arr;
+       unsigned int i;
+       struct selabel_lookup_rec *ret = NULL;
+
+       if (!data->nspec) {
+               errno = ENOENT;
+               goto finish;
+       }
+
+       for (i = 0; i < data->nspec; i++) {
+               if (strcmp(spec_arr[i].property_key, key) == 0)
+                       break;
+               if (strcmp(spec_arr[i].property_key, "*") == 0)
+                       break;
+       }
+
+       if (i >= data->nspec) {
+               /* No matching specification. */
+               errno = ENOENT;
+               goto finish;
+       }
+
+       ret = &spec_arr[i].lr;
+
+finish:
+       return ret;
+}
+
 static void stats(struct selabel_handle __attribute__((unused)) *rec)
 {
        selinux_log(SELINUX_WARNING, "'stats' functionality not implemented.\n");

@@ -298,7 +330,25 @@ int selabel_property_init(struct selabel_handle *rec,
        rec->data = data;
        rec->func_close = &closef;
        rec->func_stats = &stats;
-       rec->func_lookup = &lookup;
+       rec->func_lookup = &property_lookup;
+
+       return init(rec, opts, nopts);
+}
+
+int selabel_service_init(struct selabel_handle *rec,
+               const struct selinux_opt *opts, unsigned nopts)
+{
+       struct saved_data *data;
+
+       data = (struct saved_data *)malloc(sizeof(*data));
+       if (!data)
+               return -1;
+       memset(data, 0, sizeof(*data));
+
+       rec->data = data;
+       rec->func_close = &closef;
+       rec->func_stats = &stats;
+       rec->func_lookup = &service_lookup;
 
        return init(rec, opts, nopts);
 }
libselinux/src/label_internal.h +3 -0
index 7c55531..6a9481a 100644
@@ -39,6 +39,9 @@ int selabel_db_init(struct selabel_handle *rec,
 int selabel_property_init(struct selabel_handle *rec,
                            const struct selinux_opt *opts,
                            unsigned nopts) hidden;
+int selabel_service_init(struct selabel_handle *rec,
+                           const struct selinux_opt *opts,
+                           unsigned nopts) hidden;
 
 /*
  * Labeling internal structures
libselinux/utils/selabel_digest.c +2 -0
index 38162a5..e4d84a5 100644
@@ -92,6 +92,8 @@ int main(int argc, char **argv)
                                backend = SELABEL_CTX_DB;
                        } else if (!strcmp(optarg, "prop")) {
                                backend = SELABEL_CTX_ANDROID_PROP;
+                       } else if (!strcmp(optarg, "service")) {
+                               backend = SELABEL_CTX_ANDROID_SERVICE;
                        } else {
                                fprintf(stderr, "Unknown backend: %s\n",
                                                                    optarg);
libselinux/utils/selabel_lookup.c +2 -1
index d0b1457..b678a89 100644
@@ -57,6 +57,8 @@ int main(int argc, char **argv)
                                backend = SELABEL_CTX_DB;
                        } else if (!strcmp(optarg, "prop")) {
                                backend = SELABEL_CTX_ANDROID_PROP;
+                       } else if (!strcmp(optarg, "service")) {
+                               backend = SELABEL_CTX_ANDROID_SERVICE;
                        } else {
                                fprintf(stderr, "Unknown backend: %s\n",
                                                                    optarg);
--

1.9.1

_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected].
To get help, send an email containing "help" to [email protected].

Signature · 3 lines
Respectfully,

William C Roberts
author
#3 lore raw

Re: [PATCH 2/3] libselinux: android: fix lax service context lookup

William: Good thing you mention checkfc. I added you as a reviewer.

Quoted 199 lines · William Roberts

do you have the corresponding changes to checkfc on AOSP?

Quoted 11 lines · Janis Danisevskis

We use the same lookup function for service contexts that we use for property contexts. However, property contexts are namespace based and only compare the prefix. This may lead to service associations with a wrong label.

This patch introduces a new back end for android services with a stricter lookup function. Now the service name must match the key of the service label exactly.

Quoted 5 lines
Signed-off-by Janis Danisevskis <[email protected]>
---
 libselinux/include/selinux/label.h      |  2 ++
 libselinux/src/label.c                  |  1 +
 libselinux/src/label_backends_android.c | 54

+++++++++++++++++++++++++++++++--

Review

Quoted 6 lines
 libselinux/src/label_internal.h         |  3 ++
 libselinux/utils/selabel_digest.c       |  2 ++
 libselinux/utils/selabel_lookup.c       |  2 ++
 6 files changed, 62 insertions(+), 2 deletions(-)
(quoted diff) +0 -0

b/libselinux/include/selinux/label.h

Review

Quoted 25 lines

index f0b1e10..277287e 100644

libselinux/include/selinux/label.h +2 -0
@@ -34,6 +34,8 @@ struct selabel_handle;
 #define SELABEL_CTX_DB         3
 /* Android property service contexts */
 #define SELABEL_CTX_ANDROID_PROP 4
+/* Android service contexts */
+#define SELABEL_CTX_ANDROID_SERVICE 5
 
 /*
  * Available options
libselinux/src/label.c +1 -0
index 96a4ff1..eb0e766 100644
@@ -45,6 +45,7 @@ static selabel_initfunc initfuncs[] = {
        CONFIG_X_BACKEND(selabel_x_init),
        CONFIG_DB_BACKEND(selabel_db_init),
        &selabel_property_init,
+       &selabel_service_init,
 };
 
 static void selabel_subs_fini(struct selabel_sub *ptr)
(quoted diff) +0 -0

b/libselinux/src/label_backends_android.c

libselinux/src/label_backends_android.c static void closef(struct selabel_handle *rec) · line 247

Quoted 9 lines

index 290b438..4d6ec86 100644

libselinux/src/label_backends_android.c +1 -1
@@ -244,7 +244,7 @@ static void closef(struct selabel_handle *rec)
        free(data);
 }
 
-static struct selabel_lookup_rec *lookup(struct selabel_handle *rec,
+static struct selabel_lookup_rec *property_lookup(struct selabel_handle

*rec,

libselinux/src/label_backends_android.c static void closef(struct selabel_handle *rec) · line 249

Quoted 2 lines
libselinux/src/label_backends_android.c +0 -0
                                         const char *key,
                                         int __attribute__((unused))

type)

libselinux/src/label_backends_android.c finish: · line 282

Quoted 6 lines
libselinux/src/label_backends_android.c +1 -0
 {

@@ -279,6 +279,38 @@ finish:
        return ret;
 }
 
+static struct selabel_lookup_rec *service_lookup(struct selabel_handle

*rec,

Quoted 24 lines
libselinux/src/label_backends_android.c +24 -0
+               const char *key, int __attribute__((unused)) type)
+{
+       struct saved_data *data = (struct saved_data *)rec->data;
+       spec_t *spec_arr = data->spec_arr;
+       unsigned int i;
+       struct selabel_lookup_rec *ret = NULL;
+
+       if (!data->nspec) {
+               errno = ENOENT;
+               goto finish;
+       }
+
+       for (i = 0; i < data->nspec; i++) {
+               if (strcmp(spec_arr[i].property_key, key) == 0)
+                       break;
+               if (strcmp(spec_arr[i].property_key, "*") == 0)
+                       break;
+       }
+
+       if (i >= data->nspec) {
+               /* No matching specification. */
+               errno = ENOENT;
+               goto finish;
+       }

libselinux/src/label_backends_android.c finish:

Quoted 10 lines
libselinux/src/label_backends_android.c +7 -0
+
+       ret = &spec_arr[i].lr;
+
+finish:
+       return ret;
+}
+
 static void stats(struct selabel_handle __attribute__((unused)) *rec)
 {
        selinux_log(SELINUX_WARNING, "'stats' functionality not

implemented.\n");

libselinux/src/label_backends_android.c int selabel_property_init(struct selabel_handle

Quoted 1 line
libselinux/src/label_backends_android.c +0 -0
@@ -298,7 +330,25 @@ int selabel_property_init(struct selabel_handle

*rec,

libselinux/src/label_

Quoted 27 lines
libselinux/src/label_backends_android.c +19 -1
        rec->data = data;
        rec->func_close = &closef;
        rec->func_stats = &stats;
-       rec->func_lookup = &lookup;
+       rec->func_lookup = &property_lookup;
+
+       return init(rec, opts, nopts);
+}
+
+int selabel_service_init(struct selabel_handle *rec,
+               const struct selinux_opt *opts, unsigned nopts)
+{
+       struct saved_data *data;
+
+       data = (struct saved_data *)malloc(sizeof(*data));
+       if (!data)
+               return -1;
+       memset(data, 0, sizeof(*data));
+
+       rec->data = data;
+       rec->func_close = &closef;
+       rec->func_stats = &stats;
+       rec->func_lookup = &service_lookup;
 
        return init(rec, opts, nopts);
 }
libselinux/src/label_ renamed from libselinux/src/label_internal.h +0 -0

internal.h

Review

Quoted 14 lines

index 7c55531..6a9481a 100644

libselinux/src/label_internal.h +3 -0
@@ -39,6 +39,9 @@ int selabel_db_init(struct selabel_handle *rec,
 int selabel_property_init(struct selabel_handle *rec,
                            const struct selinux_opt *opts,
                            unsigned nopts) hidden;
+int selabel_service_init(struct selabel_handle *rec,
+                           const struct selinux_opt *opts,
+                           unsigned nopts) hidden;
 
 /*
  * Labeling internal structures
(quoted diff) +0 -0

b/libselinux/utils/selabel_digest.c

libselinux/utils/selabel_digest.c int main(int argc, char **argv) · line 99

Quoted 12 lines

index 38162a5..e4d84a5 100644

libselinux/utils/selabel_digest.c +2 -0
@@ -92,6 +92,8 @@ int main(int argc, char **argv)
                                backend = SELABEL_CTX_DB;
                        } else if (!strcmp(optarg, "prop")) {
                                backend = SELABEL_CTX_ANDROID_PROP;
+                       } else if (!strcmp(optarg, "service")) {
+                               backend = SELABEL_CTX_ANDROID_SERVICE;
                        } else {
                                fprintf(stderr, "Unknown backend: %s\n",

optarg);

Review

Quoted 1 line
(quoted diff) +0 -0

b/libselinux/utils/selabel_lookup.c

libselinux/utils/selabel_lookup.c int main(int argc, char **argv) · line 64

Quoted 12 lines

index d0b1457..b678a89 100644

libselinux/utils/selabel_lookup.c +2 -0
@@ -57,6 +57,8 @@ int main(int argc, char **argv)
                                backend = SELABEL_CTX_DB;
                        } else if (!strcmp(optarg, "prop")) {
                                backend = SELABEL_CTX_ANDROID_PROP;
+                       } else if (!strcmp(optarg, "service")) {
+                               backend = SELABEL_CTX_ANDROID_SERVICE;
                        } else {
                                fprintf(stderr, "Unknown backend: %s\n",

optarg);

Quoted 8 lines

--
1.9.1

_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to

[email protected].

--
Respectfully,

William C Roberts

author
#4 lore raw

PATCH 3/3 libselinux: makes android label back ends configurable

In reply to Janis Danisevskis

Android label back ends are not configurable by NO_ANDROID_BACKEND, which is set if on ANDROID_HOST != y.

Signed-off-by Janis Danisevskis <[email protected]>
---
 libselinux/src/Makefile |  3 +++
 libselinux/src/label.c  | 10 ++++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)
libselinux/src/Makefile +3 -0
index cba8383..7169230 100644
@@ -87,6 +87,9 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
 SRCS= callbacks.c freecon.c label.c label_file.c \
 	label_backends_android.c regex.c label_support.c \
 	matchpathcon.c setrans_client.c sha1.c
+else
+DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
+SRCS:= $(filter-out label_backends_android.c, $(SRCS))
 endif
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ $(DISABLE_FLAGS)
libselinux/src/label.c +8 -2
index eb0e766..60639cf 100644
@@ -35,6 +35,12 @@
 #define CONFIG_DB_BACKEND(fnptr) &fnptr
 #endif
 
+#ifdef NO_ANDROID_BACKEND
+#define CONFIG_ANDROID_BACKEND(fnptr) NULL
+#else
+#define CONFIG_ANDROID_BACKEND(fnptr) (&(fnptr))
+#endif
+
 typedef int (*selabel_initfunc)(struct selabel_handle *rec,
 				const struct selinux_opt *opts,
 				unsigned nopts);

@@ -44,8 +50,8 @@ static selabel_initfunc initfuncs[] = {
 	CONFIG_MEDIA_BACKEND(selabel_media_init),
 	CONFIG_X_BACKEND(selabel_x_init),
 	CONFIG_DB_BACKEND(selabel_db_init),
-	&selabel_property_init,
-	&selabel_service_init,
+	CONFIG_ANDROID_BACKEND(selabel_property_init),
+	CONFIG_ANDROID_BACKEND(selabel_service_init),
 };
 
 static void selabel_subs_fini(struct selabel_sub *ptr)
Signature · 1 line
1.9.1
Applied
#5 lore raw

Re: [PATCH 3/3] libselinux: makes android label back ends configurable

Quoted 4 lines · Janis Danisevskis

Android label back ends are not configurable by NO_ANDROID_BACKEND, which is set if on ANDROID_HOST != y.

Signed-off-by Janis Danisevskis <[email protected]>

Thanks, applied all three.

Quoted 48 lines
---
 libselinux/src/Makefile |  3 +++
 libselinux/src/label.c  | 10 ++++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)
libselinux/src/Makefile +3 -0
index cba8383..7169230 100644
@@ -87,6 +87,9 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
 SRCS= callbacks.c freecon.c label.c label_file.c \
 	label_backends_android.c regex.c label_support.c \
 	matchpathcon.c setrans_client.c sha1.c
+else
+DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
+SRCS:= $(filter-out label_backends_android.c, $(SRCS))
 endif
 
 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ $(DISABLE_FLAGS)
libselinux/src/label.c +8 -2
index eb0e766..60639cf 100644
@@ -35,6 +35,12 @@
 #define CONFIG_DB_BACKEND(fnptr) &fnptr
 #endif
 
+#ifdef NO_ANDROID_BACKEND
+#define CONFIG_ANDROID_BACKEND(fnptr) NULL
+#else
+#define CONFIG_ANDROID_BACKEND(fnptr) (&(fnptr))
+#endif
+
 typedef int (*selabel_initfunc)(struct selabel_handle *rec,
 				const struct selinux_opt *opts,
 				unsigned nopts);

@@ -44,8 +50,8 @@ static selabel_initfunc initfuncs[] = {
 	CONFIG_MEDIA_BACKEND(selabel_media_init),
 	CONFIG_X_BACKEND(selabel_x_init),
 	CONFIG_DB_BACKEND(selabel_db_init),
-	&selabel_property_init,
-	&selabel_service_init,
+	CONFIG_ANDROID_BACKEND(selabel_property_init),
+	CONFIG_ANDROID_BACKEND(selabel_service_init),
 };
 
 static void selabel_subs_fini(struct selabel_sub *ptr)