busybox -- libselinux utilities applets

PATCH In review KaiGai Kohei 5 participants 19 messages Jan 25, 2007 – Jan 31, 2007 4 messages not in the archive

Subsystems (2)

Kbuild SELinux security module

lore

Share & tools

lore

KaiGai Kohei

author

2007-01-25 14:34 UTC #0 lore raw

cover busybox -- libselinux utilities applets

Hello,

The following patches provide utilities included in libselinux package against to the latest busybox repository. Any of them are fundamental one to use SELinux.

We are welcoming any comment, and hope to merge it into busybox.

NOTE: How to configure

All applets of them depend on CONFIG_SELINUX, so you have to enable it by the following step on 'menuconfig'.

Busybox Settings --->
General Configuration --->
[*] Support NSA Security Enhanced Linux (CONFIG_SELINUX)

and, enable any checks under 'Selinux Utilities --->'

[1/8] busybox-libselinux-01-common.patch
The common part of libselinux package
- modification of Makefile
- add '-lselinux', if CONFIG_SELINUX enabled
(It was never linked, so we could not build with SELinux
support in busybox-1.4.0)
- add selinux/Config.in and selinux/Kbuild
- add usage.h and applets.h for the series of applets

[2/8] busybox-libselinux-02-getenforce.patch
getenforce - get the current mode of SELinux. SELinux has two mode. 'Enforcing' is the one, it enables mandatory access control based on the security policy. The other is 'Permissive' mode. It enables to evaluate security policy and output audit messages, if violated. But mandatory access control was not done. It was used to debug policy.

[3/8] busybox-libselinux-03-selinuxenabled.patch
selinuxenabled returns 0 as a command exit code, if SELinux is enabled.
Typically, shell-scripts use it to decide whether SELinux is working, or not.

[4/8] busybox-libselinux-04-getsebool.patch
getsebool reports the a particular or all SELinux boolean variable.
SELinux boolean variable is a interface to configure the condition of security policy. We can enable or disable the part of the security policy via boolean variable.

[5/8] busybox-libselinux-05-avcstat.patch
avcstat reports SELinux AVC(Access Vector Cache) statistics. AVC is a in-kernel data structure to accelerate SELinux's decision making.

[6/8] busybox-libselinux-06-togglesebool.patch
togglesebool - flip the current value of a SELinux boolean variable.

[7/8] busybox-libselinux-07-matchpathcon.patch
matchpathcon - get the default security context for the specified path from the file contexts configuration. Security context is a identifier for SELinux.
Any files has a own security context, and SELinux use it to evaluate the attribute of the file.
When we are setting up a system, we have to attach a security context for each files. so, we can obtain the most appropriate security context by using matchpathcon.

[8/8] busybox-libselinux-08-setenforce.patch
setenforce - modify the mode SELinux is running in Enforcing mode or Permissive.

This project is originated from some of JPSEUG(Japan SELinux User Group). Now, we are preparing to submit patches related to SELinux like policycoreutils, '-Z' option support. Please wait for a bit.

Thanks,
--
KaiGai Kohei <[email protected]>

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

KaiGai Kohei

author

2007-01-25 14:43 UTC #1 lore raw

PATCH 2/8 busybox -- libselinux utilities applets

Signed-off-by Hiroshi Shinji <[email protected]>

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

getenforce.c +40 -0

Index: selinux/getenforce.c
===================================================================
@@ -0,0 +1,40 @@
+/*
+ * getenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <selinux/selinux.h>
+
+int getenforce_main(int argc, char **argv)
+{
+	int rc;
+
+	rc = is_selinux_enabled();
+	if (rc < 0) {
+		bb_error_msg("is_selinux_enabled() failed");
+		return 2;
+	}
+	if (rc == 1) {
+		rc = security_getenforce();
+		if (rc < 0) {
+			bb_error_msg("getenforce() failed");
+			return 2;
+		}
+
+		if (rc)
+			puts("Enforcing");
+		else
+			puts("Permissive");
+	} else {
+		puts("Disabled");
+	}
+
+	return 0;
+}

A message that is not in the archive (sent off-list or not yet received): [email protected]

KaiGai Kohei

author

2007-01-29 13:46 UTC #3 lore raw

Denis, Thanks for your comments.

The attached patch uses bb_error_msg_and_die() instead of bb_error_msg() and error exit, and remove redundant headers.

Thanks,

Quoted 64 lines · Denis Vlasenko

Quoted 14 lines · KaiGai Kohei
[2/8] busybox-libselinux-02-getenforce.patch
getenforce - get the current mode of SELinux. SELinux has two mode. 'Enforcing' is the one, it enables mandatory access control based on the security policy. The other is 'Permissive' mode. It enables to evaluate security policy and output audit messages, if violated. But mandatory access control was not done. It was used to debug policy.
Signed-off-by Hiroshi Shinji <[email protected]>
Signed-off-by KaiGai Kohei <[email protected]>
--
KaiGai Kohei <[email protected]>
getenforce.c (revision 0) +22 -0
@@ -0,0 +1,40 @@
+/*
+ * getenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <selinux/selinux.h>
+
+int getenforce_main(int argc, char **argv)
+{
+       int rc;
+
+       rc = is_selinux_enabled();
+       if (rc < 0) {
+               bb_error_msg("is_selinux_enabled() failed");
+               return 2;
Will bb_error_msg_and_die work here?
getenforce.c (revision 0) +18 -0
+       }
+       if (rc == 1) {
+               rc = security_getenforce();
+               if (rc < 0) {
+                       bb_error_msg("getenforce() failed");
+                       return 2;
+               }
+
+               if (rc)
+                       puts("Enforcing");
+               else
+                       puts("Permissive");
+       } else {
+               puts("Disabled");
+       }
+
+       return 0;
+}

Signature · 1 line

KaiGai Kohei <[email protected]>

getenforce.c +34 -0

Index: selinux/getenforce.c
===================================================================
@@ -0,0 +1,34 @@
+/*
+ * getenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <selinux/selinux.h>
+
+int getenforce_main(int argc, char **argv)
+{
+	int rc;
+
+	rc = is_selinux_enabled();
+	if (rc < 0)
+		bb_error_msg_and_die("is_selinux_enabled() failed");
+
+	if (rc == 1) {
+		rc = security_getenforce();
+		if (rc < 0)
+			bb_error_msg_and_die("getenforce() failed");
+
+		if (rc)
+			puts("Enforcing");
+		else
+			puts("Permissive");
+	} else {
+		puts("Disabled");
+	}
+
+	return 0;
+}

KaiGai Kohei

author

2007-01-25 14:43 UTC #4 lore raw

PATCH 3/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

[3/8] busybox-libselinux-03-selinuxenabled.patch
selinuxenabled returns 0 as a command exit code, if SELinux is enabled.
Typically, shell-scripts use it to decide whether SELinux is working, or not.

Signed-off-by Hiroshi Shinji <[email protected]>

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

selinuxenabled.c +17 -0

Index: selinux/selinuxenabled.c
===================================================================
@@ -0,0 +1,17 @@
+/*
+ * selinuxenabled
+ * 
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+#include "busybox.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <selinux/selinux.h>
+
+int selinuxenabled_main(int argc, char **argv)
+{
+	return !is_selinux_enabled();
+}

KaiGai Kohei

author

2007-01-25 14:43 UTC #5 lore raw

PATCH 4/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

Signed-off-by Hiroshi Shinji <[email protected]>

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

getsebool.c +98 -0

Index: selinux/getsebool.c
===================================================================
@@ -0,0 +1,98 @@
+/*
+ * getsebool
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <getopt.h>
+#include <errno.h>
+#include <string.h>
+#include <selinux/selinux.h>
+
+#define GETSEBOOL_OPT_ALL	1
+
+int getsebool_main(int argc, char **argv)
+{
+	int i, rc = 0, active, pending, len = 0;
+	char **names;
+	unsigned long opt;
+
+	opt = getopt32(argc, argv, "a");
+
+	if(opt & BB_GETOPT_ERROR) {
+		bb_show_usage();
+	}
+	if(opt & GETSEBOOL_OPT_ALL) {
+		if (argc > 2)
+			bb_show_usage();
+		if (is_selinux_enabled() <= 0) {
+			bb_error_msg_and_die("SELinux is disabled");
+		}
+		errno = 0;
+		rc = security_get_boolean_names(&names, &len);
+		if (rc) {
+			bb_error_msg_and_die("Unable to get boolean names:  %s", strerror(errno));
+		}
+		if (!len) {
+			printf("No booleans\n");
+			return 0;
+		}
+	}
+
+	if (is_selinux_enabled() <= 0) {
+		bb_error_msg_and_die("SELinux is disabled");
+	}
+
+	if (!len) {
+		if (argc < 2)
+			bb_show_usage();
+		len = argc - 1;
+		names = malloc(sizeof(char *) * len);
+		if (!names) {
+			bb_error_msg_and_die("out of memory");
+		}
+		for (i = 0; i < len; i++) {
+			names[i] = strdup(argv[i + 1]);
+			if (!names[i]) {
+				bb_error_msg_and_die("out of memory");
+			}
+		}
+	}
+
+	for (i = 0; i < len; i++) {
+		active = security_get_boolean_active(names[i]);
+		if (active < 0) {
+			bb_error_msg("Error getting active value for %s",
+				names[i]);
+			rc = -1;
+			goto out;
+		}
+		pending = security_get_boolean_pending(names[i]);
+		if (pending < 0) {
+			bb_error_msg("Error getting pending value for %s",
+				names[i]);
+			rc = -1;
+			goto out;
+		}
+		if (pending != active) {
+			printf("%s --> %s pending: %s\n", names[i],
+			       (active ? "on" : "off"),
+			       (pending ? "on" : "off"));
+		} else {
+			printf("%s --> %s\n", names[i],
+			       (active ? "on" : "off"));
+		}
+	}
+
+      out:
+	for (i = 0; i < len; i++)
+		free(names[i]);
+	free(names);
+	return rc;
+}

A message that is not in the archive (sent off-list or not yet received): [email protected]

KaiGai Kohei

author

2007-01-29 14:05 UTC #7 lore raw

Denis, Thanks for your comments.

Quoted 24 lines · Denis Vlasenko

Quoted 13 lines · KaiGai Kohei
[4/8] busybox-libselinux-04-getsebool.patch
getsebool reports the a particular or all SELinux boolean variable.
SELinux boolean variable is a interface to configure the condition of security policy. We can enable or disable the part of the security policy via boolean variable.
Signed-off-by Hiroshi Shinji <[email protected]>
Signed-off-by KaiGai Kohei <[email protected]>
--
KaiGai Kohei <[email protected]>
getsebool.c (revision 0) +6 -0
@@ -0,0 +1,98 @@
+/*
+ * getsebool
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *

getsebool.c (revision 0) line 16

Quoted 10 lines

getsebool.c (revision 0) +10 -0

+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <getopt.h>
+#include <errno.h>
+#include <string.h>
+#include <selinux/selinux.h>

I removed above redundant headers.

Quoted 14 lines

getsebool.c (revision 0) +13 -0

+#define GETSEBOOL_OPT_ALL      1
+
+int getsebool_main(int argc, char **argv)
+{
+       int i, rc = 0, active, pending, len = 0;
+       char **names;
+       unsigned long opt;
+
+       opt = getopt32(argc, argv, "a");
+
+       if(opt & BB_GETOPT_ERROR) {
+               bb_show_usage();
+       }

Quoted 1 line

Is it needed? I mean, can you give an example where it is needed?

No. The above block is unnecessary.

Quoted 15 lines

getsebool.c (revision 0) +9 -0

+
+       if (!len) {
+               if (argc < 2)
+                       bb_show_usage();
+               len = argc - 1;
+               names = malloc(sizeof(char *) * len);
+               if (!names) {
+                       bb_error_msg_and_die("out of memory");
+               }

xmalloc will do dying for you! :)

getsebool.c (revision 0) +2 -0

+               for (i = 0; i < len; i++) {
+                       names[i] = strdup(argv[i + 1]);

Quoted 2 lines

xstrdup. Gotta love busybox. We love to die, and love to get rid of useless error paths.

Thanks for the useful information.
I replaced them with xmalloc() and xstrdup().

Quoted 6 lines

getsebool.c (revision 0) +4 -0
+      out:
+       for (i = 0; i < len; i++)
+               free(names[i]);
+       free(names);
Add if (ENABLE_FEATURE_CLEAN_UP) in front of for().

OK, I appended if (ENABLE_FEATURE_CLEAN_UP) { ... } block.

BTW, I found both '#if ENABLE_FEATURE_CLEAN_UP' and 'if (ENABLE_FEATURE_CLEAN_UP)' in the source tree. Which manner is preferable?

Thanks,

Signature · 1 line

KaiGai Kohei <[email protected]>

getsebool.c +83 -0

Index: selinux/getsebool.c
===================================================================
@@ -0,0 +1,83 @@
+/*
+ * getsebool
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <selinux/selinux.h>
+
+#define GETSEBOOL_OPT_ALL	1
+
+int getsebool_main(int argc, char **argv)
+{
+	int i, rc = 0, active, pending, len = 0;
+	char **names;
+	unsigned long opt;
+
+	opt = getopt32(argc, argv, "a");
+
+	if(opt & GETSEBOOL_OPT_ALL) {
+		if (argc > 2)
+			bb_show_usage();
+		if (is_selinux_enabled() <= 0) {
+			bb_error_msg_and_die("SELinux is disabled");
+		}
+		errno = 0;
+		rc = security_get_boolean_names(&names, &len);
+		if (rc) {
+			bb_error_msg_and_die("cannot get boolean names:  %s",
+					     strerror(errno));
+		}
+		if (!len) {
+			printf("No booleans\n");
+			return 0;
+		}
+	}
+
+	if (is_selinux_enabled() <= 0)
+		bb_error_msg_and_die("SELinux is disabled");
+
+	if (!len) {
+		if (argc < 2)
+			bb_show_usage();
+		len = argc - 1;
+		names = xmalloc(sizeof(char *) * len);
+		for (i = 0; i < len; i++)
+			names[i] = xstrdup(argv[i + 1]);
+	}
+
+	for (i = 0; i < len; i++) {
+		active = security_get_boolean_active(names[i]);
+		if (active < 0) {
+			bb_error_msg("error getting active value for %s", names[i]);
+			rc = -1;
+			goto out;
+		}
+		pending = security_get_boolean_pending(names[i]);
+		if (pending < 0) {
+			bb_error_msg("error getting pending value for %s", names[i]);
+			rc = -1;
+			goto out;
+		}
+		if (pending != active) {
+			printf("%s --> %s pending: %s\n", names[i],
+			       (active ? "on" : "off"),
+			       (pending ? "on" : "off"));
+		} else {
+			printf("%s --> %s\n", names[i],
+			       (active ? "on" : "off"));
+		}
+	}
+
+      out:
+	if (ENABLE_FEATURE_CLEAN_UP) {
+		for (i = 0; i < len; i++)
+			free(names[i]);
+		free(names);
+	}
+
+	return rc;
+}

A message that is not in the archive (sent off-list or not yet received): [email protected]

KaiGai Kohei

2007-01-31 12:15 UTC #9 lore raw

Bernhard, Thanks for your comments.

The attached patch fixes following items:
- avcstat and togglesebool applet were removed
- xis_selinux_enabled() was added at libbb/xfuncs.c
- unneccesary headers were removed.
- bb_error_msg_and_die() + strerror() were replaced
with bb_perror_msg_and_die()
- "Selinux Utilities" at menuconfig got dependency with CONFIG_SELINUX
- some cleanups.

Quoted 21 lines

Index: selinux/getsebool.c
===================================================================

getsebool.c +16 -0

@@ -0,0 +1,83 @@
+/*
+ * getsebool
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <selinux/selinux.h>
+
+#define GETSEBOOL_OPT_ALL	1
+
+int getsebool_main(int argc, char **argv)
+{
+	int i, rc = 0, active, pending, len = 0;

Quoted 8 lines

getsebool.c line 22
Quoted 6 lines
getsebool.c +6 -0
+	char **names;
+	unsigned long opt;
+
+	opt = getopt32(argc, argv, "a");
+
+	if(opt & GETSEBOOL_OPT_ALL) {
missing space after "if"

Fixed, and confirmed a space is placed after any 'if' and 'for' in front of '('.

Quoted 6 lines

getsebool.c line 26
Quoted 4 lines
getsebool.c +4 -0
+		if (argc > 2)
+			bb_show_usage();
+		if (is_selinux_enabled() <= 0) {
+			bb_error_msg_and_die("SELinux is disabled");
You're doing this alot. Please move this out to a

Quoted 7 lines

int xis_selinux_enabled(void) {
	smallint ret = is_selinux_enabled();
	if (ret != 1)
		bb_error_msg_and_die("SELinux is disabled");
	return ret;
}
in e.g. libbb/xfuncs.c and use it in your other SElinux applets, too.

I added xis_selinux_enabled() at libbb/xfuncs.c to die if SELinux was disabled. Some similar implementations are replaced.

Quoted 4 lines

getsebool.c line 28
Quoted 2 lines
getsebool.c +2 -0
+		}
+		errno = 0;
hm?

removed it.

Quoted 7 lines

getsebool.c line 30
Quoted 2 lines
getsebool.c +2 -0
+		rc = security_get_boolean_names(&names, &len);
+		if (rc) {
->+ bb_error_msg_and_die("cannot get boolean names: %s",
->+ strerror(errno));
bb_perror_msg_and_die("cannot get boolean name");
should do too

The combination of bb_error_msg_and_die() and strerror() was replaced by bb_perror_msg_and_die()

Quoted 5 lines

getsebool.c line 33
Quoted 3 lines
getsebool.c +3 -0
+		}
+		if (!len) {
+			printf("No booleans\n");
puts smaller?

Agreed. It was replaced with puts().

Quoted 11 lines

getsebool.c line 36
Quoted 3 lines
getsebool.c +3 -0
+			return 0;
+		}
+	}
See how you didn't use opt much?
I'd rather say xis_selinux_enabled(); opt_complementary="-1";/* need at least 1 non-option arg*/
if (getopt32(argc, argv, "a")) {
	rc = security_get_boolean_names(&names, &len);
	if (rc ...
}

When we use '-a' option, any other non-option arguments are not allowed. Thus, we cannot use the above opt_complementary.

Quoted 7 lines

getsebool.c line 39
Quoted 3 lines
getsebool.c +3 -0
+
+	if (is_selinux_enabled() <= 0)
+		bb_error_msg_and_die("SELinux is disabled");
That can't be right, no?
You called security_get_boolean_names() before checking if selinux is enabled or not. Does this work?

No, the above security_get_boolean_names() was called after checking if selinux is enabled or not in the 'if (opt & GETSEBOOL_OPT_ALL) {...}' block.

Quoted 3 lines

What about removing that is_selinux_enabled block here, move the call to xis_selinux_enabled from the "if(opt & GETSEBOOL_OPT_ALL) {" block to below the "if (opt..)" block so you check for enabled only once (before
get_boolean_nam())

I agreed it.
xis_selinux_enabled() was moved at light after getopt32(). It will be done only once.

Thanks,

Signature · 2 lines

Open Source Software Promotion Center, NEC
KaiGai Kohei <[email protected]>

libbb/xfuncs.c +11 -0

Index: sebusybox-libselinux-0131/libbb/xfuncs.c
===================================================================
@@ -574,6 +574,17 @@
 		bb_perror_msg_and_die("can't stat '%s'", name);
 }
 
+// xis_selinux_enabled() - die if SELinux is disabled.
+void xis_selinux_enabled(void)
+{
+#ifdef CONFIG_SELINUX
+	if (!is_selinux_enabled())
+		bb_error_msg_and_die("SELinux is disabled");
+#else
+	bb_error_msg_and_die("SELinux support is disabled");
+#endif
+}
+
 /* It is perfectly ok to pass in a NULL for either width or for
  * height, in which case that value will not be set.  */
 int get_terminal_width_height(const int fd, int *width, int *height)

Makefile +1 -0

Index: sebusybox-libselinux-0131/Makefile
===================================================================
@@ -442,6 +442,7 @@
 		networking/udhcp/ \
 		procps/ \
 		runit/ \
+		selinux/ \
 		shell/ \
 		sysklogd/ \
 		util-linux/ \

include/libbb.h +1 -0

Index: sebusybox-libselinux-0131/include/libbb.h
===================================================================
@@ -571,6 +571,7 @@
 extern void renew_current_security_context(void);
 extern void set_current_security_context(security_context_t sid);
 #endif
+extern void xis_selinux_enabled(void);
 extern int restricted_shell(const char *shell);
 extern void setup_environment(const char *shell, int loginshell, int changeenv, const struct passwd *pw);
 extern int correct_password(const struct passwd *pw);

include/usage.h +24 -0

Index: sebusybox-libselinux-0131/include/usage.h
===================================================================
@@ -1013,6 +1013,9 @@
        "	-6	When using port/proto only search IPv6 space\n" \
        "	-SIGNAL	When used with -k, this signal will be used to kill"
 
+#define getenforce_trivial_usage
+#define getenforce_full_usage
+
 #define getopt_trivial_usage \
        "[OPTIONS]..."
 #define getopt_full_usage \

@@ -1047,6 +1050,11 @@
        " esac\n" \
        "done\n"
 
+#define getsebool_trivial_usage \
+	"-a or getsebool boolean..."
+#define getsebool_full_usage \
+	"-a     Show all SELinux booleans."
+
 #define getty_trivial_usage \
        "[OPTIONS]... baud_rate,... line [termtype]"
 #define getty_full_usage \

@@ -1896,6 +1904,15 @@
        "/dev/hda[0-15]\n"
 #endif
 
+#define matchpathcon_trivial_usage \
+	"[-n] [-N] [-f file_contexts_file] [-p prefix] [-V]"
+#define matchpathcon_full_usage \
+	"\t-n Do not display path.\n" \
+	"\t-N Do not use translations.\n" \
+	"\t-f file_context_file Use alternate file_context file\n" \
+	"\t-p prefix Use prefix to speed translations\n" \
+	"\t-V Verify file context on disk matches defaults"
+
 #define md5sum_trivial_usage \
        "[OPTION] [FILEs...]" \
 	USE_FEATURE_MD5_SHA1_SUM_CHECK("\n   or: md5sum [OPTION] -c [FILE]")

@@ -2714,6 +2731,9 @@
        "$ echo \"foo\" | sed -e 's/f[a-zA-Z]o/bar/g'\n" \
        "bar\n"
 
+#define selinuxenabled_trivial_usage
+#define selinuxenabled_full_usage
+
 #define seq_trivial_usage \
        "[first [increment]] last"
 #define seq_full_usage \

@@ -2731,6 +2751,10 @@
        "\n\nOptions:\n" \
        "	-r	Reset output to /dev/console"
 
+#define setenforce_trivial_usage \
+	"[ Enforcing | Permissive | 1 | 0 ]"
+#define setenforce_full_usage
+
 #define setkeycodes_trivial_usage \
        "SCANCODE KEYCODE ..."
 #define setkeycodes_full_usage \

include/applets.h +5 -0

Index: sebusybox-libselinux-0131/include/applets.h
===================================================================
@@ -133,7 +133,9 @@
 USE_FTPGET(APPLET_ODDNAME(ftpget, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpget))
 USE_FTPPUT(APPLET_ODDNAME(ftpput, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpput))
 USE_FUSER(APPLET(fuser, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_GETENFORCE(APPLET(getenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETOPT(APPLET(getopt, _BB_DIR_BIN, _BB_SUID_NEVER))
+USE_GETSEBOOL(APPLET(getsebool, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETTY(APPLET(getty, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_GREP(APPLET(grep, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_GUNZIP(APPLET(gunzip, _BB_DIR_BIN, _BB_SUID_NEVER))

@@ -187,6 +189,7 @@
 USE_LSATTR(APPLET(lsattr, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_LSMOD(APPLET(lsmod, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_UNLZMA(APPLET_ODDNAME(lzmacat, unlzma, _BB_DIR_USR_BIN, _BB_SUID_NEVER, lzmacat))
+USE_MATCHPATHCON(APPLET(matchpathcon, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_MAKEDEVS(APPLET(makedevs, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_MD5SUM(APPLET_ODDNAME(md5sum, md5_sha1_sum, _BB_DIR_USR_BIN, _BB_SUID_NEVER, md5sum))
 USE_MDEV(APPLET(mdev, _BB_DIR_SBIN, _BB_SUID_NEVER))

@@ -249,10 +252,12 @@
 USE_RUNSV(APPLET(runsv, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RUNSVDIR(APPLET(runsvdir, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RX(APPLET(rx, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_SELINUXENABLED(APPLET(selinuxenabled, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SED(APPLET(sed, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SEQ(APPLET(seq, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETARCH(APPLET(setarch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SETCONSOLE(APPLET(setconsole, _BB_DIR_SBIN, _BB_SUID_NEVER))
+USE_SETENFORCE(APPLET(setenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETKEYCODES(APPLET(setkeycodes, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETLOGCONS(APPLET(setlogcons, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETSID(APPLET(setsid, _BB_DIR_USR_BIN, _BB_SUID_NEVER))

selinux/getenforce.c +33 -0

Index: sebusybox-libselinux-0131/selinux/getenforce.c
===================================================================
@@ -0,0 +1,33 @@
+/*
+ * getenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+
+int getenforce_main(int argc, char **argv)
+{
+	int rc;
+
+	rc = is_selinux_enabled();
+	if (rc < 0)
+		bb_error_msg_and_die("is_selinux_enabled() failed");
+
+	if (rc == 1) {
+		rc = security_getenforce();
+		if (rc < 0)
+			bb_error_msg_and_die("getenforce() failed");
+
+		if (rc)
+			puts("Enforcing");
+		else
+			puts("Permissive");
+	} else {
+		puts("Disabled");
+	}
+
+	return 0;
+}

selinux/selinuxenabled.c +13 -0

Index: sebusybox-libselinux-0131/selinux/selinuxenabled.c
===================================================================
@@ -0,0 +1,13 @@
+/*
+ * selinuxenabled
+ * 
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+#include "busybox.h"
+
+int selinuxenabled_main(int argc, char **argv)
+{
+	return !is_selinux_enabled();
+}

selinux/getsebool.c +73 -0

73 lines not on this page · raw message

selinux/Kbuild +13 -0

Index: sebusybox-libselinux-0131/selinux/Kbuild
===================================================================
@@ -0,0 +1,13 @@
+# Makefile for busybox
+#
+# Copyright (C) 1999-2005 by Erik Andersen <[email protected]>
+# Copyright (C) 2007 by KaiGai Kohei <[email protected]>
+#
+# Licensed under the GPL v2, see the file LICENSE in this tarball.
+
+lib-y:=
+lib-$(CONFIG_GETENFORCE)	+= getenforce.o
+lib-$(CONFIG_GETSEBOOL)		+= getsebool.o
+lib-$(CONFIG_MATCHPATHCON)	+= matchpathcon.o
+lib-$(CONFIG_SELINUXENABLED)	+= selinuxenabled.o
+lib-$(CONFIG_SETENFORCE)	+= setenforce.o

selinux/Config.in +47 -0

47 lines not on this page · raw message

selinux/matchpathcon.c +98 -0

98 lines not on this page · raw message

selinux/setenforce.c +33 -0

Index: sebusybox-libselinux-0131/selinux/setenforce.c
===================================================================
@@ -0,0 +1,33 @@
+/*
+ * setenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+
+int setenforce_main(int argc, char **argv)
+{
+	int rc = 0;
+	if (argc != 2)
+		bb_show_usage();
+
+	xis_selinux_enabled();
+
+	if ((argv[1][0] == '0' || argv[1][0] == '1') && argv[1][1] == '\0') {
+		rc = security_setenforce(atoi(argv[1]));
+	} else {
+		if (strcasecmp(argv[1], "enforcing") == 0) {
+			rc = security_setenforce(1);
+		} else if (strcasecmp(argv[1], "permissive") == 0) {
+			rc = security_setenforce(0);
+		} else
+			bb_show_usage();
+	}
+	if (rc < 0)
+		bb_perror_msg_and_die("setenforce() failed : ");
+
+	return 0;
+}

Makefile.flags +4 -0

Index: sebusybox-libselinux-0131/Makefile.flags
===================================================================
@@ -54,4 +54,8 @@
 ifeq ($(CONFIG_STATIC),y)
 LDFLAGS += -static
 endif
+
+ifeq ($(CONFIG_SELINUX),y)
+LDFLAGS += -lselinux -lsepol
+endif
 #LDFLAGS += -nostdlib

Config.in +1 -0

Index: sebusybox-libselinux-0131/Config.in
===================================================================
@@ -493,3 +493,4 @@
 source shell/Config.in
 source sysklogd/Config.in
 source runit/Config.in
+source selinux/Config.in

KaiGai Kohei

author

2007-01-25 14:43 UTC #10 lore raw

PATCH 5/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

[5/8] busybox-libselinux-05-avcstat.patch
avcstat reports SELinux AVC(Access Vector Cache) statistics. AVC is a in-kernel data structure to accelerate SELinux's decision making.

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

avcstat.c +201 -0

Index: selinux/avcstat.c
===================================================================
@@ -0,0 +1,201 @@
+/*
+ * avcstat - Display SELinux avc statistics.
+ *           based on libselinux-1.32
+ * Port to busybox: KaiGai Kohei <[email protected]>
+ *
+ * Copyright (C) 2004 Red Hat, Inc., James Morris <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2,
+ * as published by the Free Software Foundation.
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <libgen.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <linux/limits.h>
+#include "busybox.h"
+
+#define DEF_STAT_FILE	"/avc/cache_stats"
+#define DEF_BUF_SIZE	8192
+#define HEADERS		"lookups hits misses allocations reclaims frees"
+
+struct avc_cache_stats {
+	unsigned long long lookups;
+	unsigned long long hits;
+	unsigned long long misses;
+	unsigned long long allocations;
+	unsigned long long reclaims;
+	unsigned long long frees;
+};
+
+static int interval;
+static int rows;
+static char *progname;
+static char buf[DEF_BUF_SIZE];
+
+/* selinuxfs mount point */
+extern char *selinux_mnt;
+
+static void set_window_rows(void)
+{
+	int ret;
+	struct winsize ws;
+
+	ret = ioctl(fileno(stdout), TIOCGWINSZ, &ws);
+	if (ret < 0 || ws.ws_row < 3)
+		ws.ws_row = 24;
+	rows = ws.ws_row;
+}
+
+static void sighandler(int num)
+{
+	if (num == SIGWINCH)
+		set_window_rows();
+}
+
+#define OPT_AVCSTAT_CUMULATIVE		(1 << 0)	/* -c */
+#define OPT_AVCSTAT_STATFILE		(1 << 1)	/* -f */
+#define OPT_AVCSTAT_HELP		(1 << 2)	/* -h */
+
+int avcstat_main(int argc, char **argv)
+{
+	struct avc_cache_stats tot, rel, last;
+	int fd, i, cumulative = 0;
+	struct sigaction sa;
+	char avcstatfile[PATH_MAX];
+	char *altstatfile;
+	unsigned long opts;
+
+	snprintf(avcstatfile, sizeof avcstatfile, "%s%s", selinux_mnt,
+		 DEF_STAT_FILE);
+	progname = basename(argv[0]);
+
+	memset(&last, 0, sizeof(last));
+	opts = getopt32(argc, argv, "cf:h", &altstatfile);
+	if (opts & (OPT_AVCSTAT_HELP | BB_GETOPT_ERROR))
+		bb_show_usage();
+	if (opts & OPT_AVCSTAT_CUMULATIVE)
+		cumulative = 1;
+	if (opts & OPT_AVCSTAT_STATFILE)
+		strncpy(avcstatfile, altstatfile, sizeof(avcstatfile));
+
+	if (optind < argc) {
+		char *arg = argv[optind];
+		unsigned int n = strtoul(arg, NULL, 10);
+
+		if (errno == ERANGE) {
+			bb_show_usage();
+			bb_error_msg_and_die("invalid interval \'%s\'", arg);
+		}
+		if (n == 0) {
+			bb_show_usage();
+			exit(0);
+		}
+		interval = n;
+	}
+
+	sa.sa_handler = sighandler;
+	sa.sa_flags = SA_RESTART;
+
+	i = sigaction(SIGWINCH, &sa, NULL);
+	if (i < 0)
+		bb_error_msg_and_die("sigaction");
+
+	set_window_rows();
+	fd = open(avcstatfile, O_RDONLY);
+	if (fd < 0)
+		bb_error_msg_and_die("open: \'%s\'", avcstatfile);
+
+	for (i = 0;; i++) {
+		char *line;
+		ssize_t ret, parsed = 0;
+
+		memset(buf, 0, DEF_BUF_SIZE);
+		ret = read(fd, buf, DEF_BUF_SIZE);
+		if (ret < 0)
+			bb_error_msg_and_die("read");
+
+		if (ret == 0)
+			bb_error_msg_and_die("read: \'%s\': unexpected end of file",
+			    avcstatfile);
+
+		line = strtok(buf, "\n");
+		if (!line)
+			bb_error_msg_and_die("unable to parse \'%s\': end of line not found",
+			    avcstatfile);
+
+		if (strcmp(line, HEADERS))
+			bb_error_msg_and_die("unable to parse \'%s\': invalid headers",
+			    avcstatfile);
+
+		if (!i || !(i % (rows - 2)))
+			printf("%10s %10s %10s %10s %10s %10s\n", "lookups",
+			       "hits", "misses", "allocs", "reclaims", "frees");
+
+		memset(&tot, 0, sizeof(tot));
+
+		while ((line = strtok(NULL, "\n"))) {
+			struct avc_cache_stats tmp;
+
+			ret = sscanf(line, "%llu %llu %llu %llu %llu %llu",
+				     &tmp.lookups,
+				     &tmp.hits,
+				     &tmp.misses,
+				     &tmp.allocations,
+				     &tmp.reclaims, &tmp.frees);
+			if (ret != 6)
+				bb_error_msg_and_die("unable to parse \'%s\': scan error",
+				    avcstatfile);
+
+			tot.lookups += tmp.lookups;
+			tot.hits += tmp.hits;
+			tot.misses += tmp.misses;
+			tot.allocations += tmp.allocations;
+			tot.reclaims += tmp.reclaims;
+			tot.frees += tmp.frees;
+			parsed = 1;
+		}
+
+		if (!parsed)
+			bb_error_msg_and_die("unable to parse \'%s\': no data", avcstatfile);
+
+		if (cumulative || (!cumulative && !i))
+			printf("%10Lu %10Lu %10Lu %10Lu %10Lu %10Lu\n",
+			       tot.lookups, tot.hits, tot.misses,
+			       tot.allocations, tot.reclaims, tot.frees);
+		else {
+			rel.lookups = tot.lookups - last.lookups;
+			rel.hits = tot.hits - last.hits;
+			rel.misses = tot.misses - last.misses;
+			rel.allocations = tot.allocations - last.allocations;
+			rel.reclaims = tot.reclaims - last.reclaims;
+			rel.frees = tot.frees - last.frees;
+			printf("%10Lu %10Lu %10Lu %10Lu %10Lu %10Lu\n",
+			       rel.lookups, rel.hits, rel.misses,
+			       rel.allocations, rel.reclaims, rel.frees);
+		}
+
+		if (!interval)
+			break;
+
+		memcpy(&last, &tot, sizeof(last));
+		sleep(interval);
+
+		ret = lseek(fd, 0, 0);
+		if (ret < 0)
+			bb_error_msg_and_die("lseek");
+	}
+
+	close(fd);
+	return 0;
+}

Christopher J. PeBenito

2007-01-26 20:07 UTC #11 lore raw

Quoted 4 lines · KaiGai Kohei

[5/8] busybox-libselinux-05-avcstat.patch
avcstat reports SELinux AVC(Access Vector Cache) statistics. AVC is a in-kernel data structure to accelerate SELinux's decision making.

Are you sure this should be added? It doesn't seem like it would be used much. I don't think most people are even aware that you can get stats on the AVC, much less know what to do with them.

Signature · 9 lines

Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Russell Coker

2007-01-29 12:26 UTC #12 lore raw

Quoted 9 lines · Christopher J. PeBenito

Quoted 4 lines · KaiGai Kohei
[5/8] busybox-libselinux-05-avcstat.patch
avcstat reports SELinux AVC(Access Vector Cache) statistics. AVC is a in-kernel data structure to accelerate SELinux's decision making.
Are you sure this should be added? It doesn't seem like it would be used much. I don't think most people are even aware that you can get stats on the AVC, much less know what to do with them.

I agree. avcstat is used only rarely and only in development. I don't think that it's something we need in production on an iPaQ, for system recovery, or in an initramfs - therefore I think it's something that isn't needed in busybox.

As for togglesebool, should such a thing even exist? Before we had setenforce we had avc_toggle which was very similar to togglesebool - and it was generally regarded that avc_toggle should not exist.

Good work on the busybox development KaiGai, it's something that needed to be done for a while. But I think you were a little over-enthusiastic in regard to those two commands.

Signature · 9 lines

[email protected]
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

KaiGai Kohei

author

2007-01-29 14:43 UTC #13 lore raw

Hi, Thanks for your comments.

Quoted 6 lines · Russell Coker

Quoted 5 lines · Christopher J. PeBenito
Quoted 4 lines · KaiGai Kohei
[5/8] busybox-libselinux-05-avcstat.patch
avcstat reports SELinux AVC(Access Vector Cache) statistics. AVC is a in-kernel data structure to accelerate SELinux's decision making.

Quoted 7 lines

Quoted 3 lines
Are you sure this should be added? It doesn't seem like it would be used much. I don't think most people are even aware that you can get stats on the AVC, much less know what to do with them.
I agree. avcstat is used only rarely and only in development. I don't think that it's something we need in production on an iPaQ, for system recovery, or in an initramfs - therefore I think it's something that isn't needed in busybox.
As for togglesebool, should such a thing even exist? Before we had setenforce we had avc_toggle which was very similar to togglesebool - and it was generally regarded that avc_toggle should not exist.

Our primary motivation is that porting some of significant SELinux utilities without any unexpected incompatibility.
Therefore, the serious of patches implements all of liblisenux utilities.

But your opinions are persuasive, I can agree to suspend the patches of avcstat and togglesebool.

Denis, I would like to suspend the 5th and 6th patches by above reason.

Quoted 1 line

Good work on the busybox development KaiGai, it's something that needed to be done for a while. But I think you were a little over-enthusiastic in regard to those two commands.

The list of our works (which include unsubmitted ones) are here:
http://code.google.com/p/sebusybox/

We want any comments about its necessity and so on.

Thanks,

Signature · 6 lines

KaiGai Kohei <[email protected]>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

KaiGai Kohei

author

2007-01-25 14:44 UTC #14 lore raw

PATCH 6/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

[6/8] busybox-libselinux-06-togglesebool.patch
togglesebool - flip the current value of a SELinux boolean variable.

Signed-off-by Hiroshi Shinji <[email protected]>

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

togglesebool.c +106 -0

Index: selinux/togglesebool.c
===================================================================
@@ -0,0 +1,106 @@
+/*
+ * togglesebool
+ * 
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ * Copyright 1999-2004 Gentoo Technologies, Inc.
+ * Distributed under the terms of the GNU General Public License v2
+ * $Header: /var/cvsroot/gentoo-projects/hardened/policycoreutils-extra/src/toggle_bool.c,v 1.2 2004/06/18 04:09:04 pebenito Exp $
+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <libgen.h>
+#include <errno.h>
+#include <selinux/selinux.h>
+#include <syslog.h>
+#include <pwd.h>
+#include <string.h>
+
+/* Attempt to rollback the transaction. No need to check error
+   codes since this is rolling back something that blew up. */
+static void rollback(int argc, char **argv)
+{
+	int i;
+
+	for (i = 1; i < argc; i++)
+		security_set_boolean(argv[i],
+				     security_get_boolean_active(argv[i]));
+	exit(1);
+}
+
+int togglesebool_main(int argc, char **argv)
+{
+
+	int rc, i, commit = 0;
+
+	if (is_selinux_enabled() <= 0) {
+		bb_error_msg_and_die("SELinux is disabled");
+	}
+
+	if (argc < 2) {
+		bb_show_usage();
+	}
+
+	for (i = 1; i < argc; i++) {
+		printf("%s: ", argv[i]);
+		rc = security_get_boolean_active(argv[i]);
+		switch (rc) {
+		case 1:
+			if (security_set_boolean(argv[i], 0) >= 0) {
+				printf("inactive\n");
+				commit++;
+			} else {
+				printf("%s - rolling back all changes\n",
+				       strerror(errno));
+				rollback(i, argv);
+			}
+			break;
+		case 0:
+			if (security_set_boolean(argv[i], 1) >= 0) {
+				printf("active\n");
+				commit++;
+			} else {
+				printf("%s - rolling back all changes\n",
+				       strerror(errno));
+				rollback(i, argv);
+			}
+			break;
+		default:
+			if (errno == ENOENT)
+				printf
+				    ("Boolean does not exist - rolling back all changes.\n");
+			else
+				printf("%s - rolling back all changes.\n",
+				       strerror(errno));
+			rollback(i, argv);
+			break;	/* Not reached. */
+		}
+	}
+
+	if (commit > 0) {
+		if (security_commit_booleans() < 0) {
+			printf("Commit failed. (%s)  No change to booleans.\n",
+			       strerror(errno));
+		} else {
+			/* syslog all the changes */
+			struct passwd *pwd = getpwuid(getuid());
+			for (i = 1; i < argc; i++) {
+				if (pwd && pwd->pw_name)
+					syslog(LOG_NOTICE,
+					       "The %s policy boolean was toggled by %s",
+					       argv[i], pwd->pw_name);
+				else
+					syslog(LOG_NOTICE,
+					       "The %s policy boolean was toggled by uid:%d",
+					       argv[i], getuid());
+
+			}
+			return 0;
+		}
+	}
+	return 1;
+}

KaiGai Kohei

author

2007-01-25 14:44 UTC #15 lore raw

PATCH 7/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

matchpathcon.c +108 -0

Index: selinux/matchpathcon.c
===================================================================
@@ -0,0 +1,108 @@
+/* matchpathcon  -  get the default security context for the specified
+ *                  path from the file contexts configuration.
+ *                  based on libselinux-1.32
+ * Port to busybox: KaiGai Kohei <[email protected]>
+ *
+ */
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <errno.h>
+#include <string.h>
+#include <selinux/selinux.h>
+#include "busybox.h"
+
+static int printmatchpathcon(char *path, int header)
+{
+	char *buf;
+	int rc = matchpathcon(path, 0, &buf);
+	if (rc < 0) {
+		fprintf(stderr, "matchpathcon(%s) failed: %s\n", path,
+			strerror(errno));
+		return 1;
+	}
+	if (header)
+		printf("%s\t%s\n", path, buf);
+	else
+		printf("%s\n", buf);
+
+	freecon(buf);
+	return 0;
+}
+
+#define MATCHPATHCON_OPT_NOT_PRINT	(1<<0)	/* -n */
+#define MATCHPATHCON_OPT_NOT_TRANS	(1<<1)	/* -N */
+#define MATCHPATHCON_OPT_FCONTEXT	(1<<2)	/* -f */
+#define MATCHPATHCON_OPT_PREFIX		(1<<3)	/* -p */
+#define MATCHPATHCON_OPT_VERIFY		(1<<4)	/* -V */
+
+int matchpathcon_main(int argc, char **argv)
+{
+	int i;
+	int header = 1;
+	int verify = 0;
+	int notrans = 0;
+	int error = 0;
+	unsigned long opts;
+	char *fcontext, *prefix;
+
+	if (argc < 2)
+		bb_show_usage();
+
+	opts = getopt32(argc, argv, "nNf:p:V", &fcontext, &prefix);
+	if (opts & BB_GETOPT_ERROR)
+		bb_show_usage();
+	if (opts & MATCHPATHCON_OPT_NOT_PRINT)
+		header = 0;
+	if (opts & MATCHPATHCON_OPT_NOT_TRANS) {
+		notrans = 1;
+		set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
+	}
+	if ((opts & MATCHPATHCON_OPT_FCONTEXT) && (opts & MATCHPATHCON_OPT_PREFIX))
+		bb_error_msg_and_die("-f and -p are exclusive");
+
+	if (opts & MATCHPATHCON_OPT_FCONTEXT) {
+		if (matchpathcon_init(fcontext))
+			bb_error_msg_and_die("Error while processing %s: %s",
+					     fcontext, errno ? strerror(errno) : "invalid");
+	}
+	if (opts & MATCHPATHCON_OPT_PREFIX) {
+		if (matchpathcon_init_prefix(NULL, prefix))
+			bb_error_msg_and_die("Error while processing %s:  %s",
+					     prefix, errno ? strerror(errno) : "invalid");
+	}
+	if (opts & MATCHPATHCON_OPT_VERIFY)
+		verify = 1;
+
+	for (i = optind; i < argc; i++) {
+		if (verify) {
+			if (selinux_file_context_verify(argv[i], 0)) {
+				printf("%s verified.\n", argv[i]);
+			} else {
+				security_context_t con;
+				int rc;
+				if (notrans)
+					rc = lgetfilecon_raw(argv[i], &con);
+				else
+					rc = lgetfilecon(argv[i], &con);
+
+				if (rc >= 0) {
+					printf("%s has context %s, should be ",
+					       argv[i], con);
+					error += printmatchpathcon(argv[i], 0);
+					freecon(con);
+				} else {
+					printf
+					    ("actual context unknown: %s, should be ",
+					     strerror(errno));
+					error += printmatchpathcon(argv[i], 0);
+				}
+			}
+		} else {
+			error += printmatchpathcon(argv[i], header);
+		}
+	}
+	matchpathcon_fini();
+	return error;
+}

A message that is not in the archive (sent off-list or not yet received): [email protected]

KaiGai Kohei

author

2007-01-29 13:43 UTC #17 lore raw

Denis,

Thanks for your comments.

Quoted 24 lines · Denis Vlasenko

Quoted 14 lines · KaiGai Kohei
[7/8] busybox-libselinux-07-matchpathcon.patch
matchpathcon - get the default security context for the specified path from the file contexts configuration. Security context is a identifier for SELinux.
Any files has a own security context, and SELinux use it to evaluate the attribute of the file.
When we are setting up a system, we have to attach a security context for each files. so, we can obtain the most appropriate security context by using matchpathcon.
Signed-off-by KaiGai Kohei <[email protected]>
--
KaiGai Kohei <[email protected]>
matchpathcon.c (revision 0) +4 -0
@@ -0,0 +1,108 @@
+/* matchpathcon  -  get the default security context for the specified
+ *                  path from the file contexts configuration.
+ *                  based on libselinux-1.32
+ * Port to busybox: KaiGai Kohei <[email protected]>

matchpathcon.c (revision 0) line 14

Quoted 10 lines

matchpathcon.c (revision 0) +10 -0

+ *
+ */
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <errno.h>
+#include <string.h>
+#include <selinux/selinux.h>
+#include "busybox.h"

I removed above redundant headers.

Quoted 50 lines

matchpathcon.c (revision 0) +49 -0

+
+static int printmatchpathcon(char *path, int header)
+{
+       char *buf;
+       int rc = matchpathcon(path, 0, &buf);
+       if (rc < 0) {
+               fprintf(stderr, "matchpathcon(%s) failed: %s\n", path,
+                       strerror(errno));
+               return 1;
+       }
+       if (header)
+               printf("%s\t%s\n", path, buf);
+       else
+               printf("%s\n", buf);
+
+       freecon(buf);
+       return 0;
+}
+
+#define MATCHPATHCON_OPT_NOT_PRINT     (1<<0)  /* -n */
+#define MATCHPATHCON_OPT_NOT_TRANS     (1<<1)  /* -N */
+#define MATCHPATHCON_OPT_FCONTEXT      (1<<2)  /* -f */
+#define MATCHPATHCON_OPT_PREFIX                (1<<3)  /* -p */
+#define MATCHPATHCON_OPT_VERIFY                (1<<4)  /* -V */
+
+int matchpathcon_main(int argc, char **argv)
+{
+       int i;
+       int header = 1;
+       int verify = 0;
+       int notrans = 0;
+       int error = 0;
+       unsigned long opts;
+       char *fcontext, *prefix;
+
+       if (argc < 2)
+               bb_show_usage();
+
+       opts = getopt32(argc, argv, "nNf:p:V", &fcontext, &prefix);
+       if (opts & BB_GETOPT_ERROR)
+               bb_show_usage();
+       if (opts & MATCHPATHCON_OPT_NOT_PRINT)
+               header = 0;
+       if (opts & MATCHPATHCON_OPT_NOT_TRANS) {
+               notrans = 1;
+               set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
+       }
+       if ((opts & MATCHPATHCON_OPT_FCONTEXT) && (opts & MATCHPATHCON_OPT_PREFIX))
+               bb_error_msg_and_die("-f and -p are exclusive");

Quoted 2 lines

This can be forced by just setting opt_complementary. There are a lot of examples in the tree.

The fixed patch uses opt_complementary and omit unnecessary as follows:

         :
    opt_complementary = "?:f--p:p--f";
    opts = getopt32(argc, argv, "nNf:p:V", &fcontext, &prefix);
         :

Quoted 6 lines

matchpathcon.c (revision 0) +3 -0
+       if (opts & MATCHPATHCON_OPT_FCONTEXT) {
+               if (matchpathcon_init(fcontext))
+                       bb_error_msg_and_die("Error while processing %s: %s",
"<applet>: Error while...." -- 'E' shpould be 'e' (small letter) here (and everywhere in bb_[ph]errorXXX)

OK, fixed.

- <snip> -

Quoted 11 lines

Typically I avoid excessive indentation:

               if (!verify) {
                       error += printmatchpathcon(argv[i], header);
                       continue;
               }
               ...here entire old "if(verify)" block needs no indent now:
               if (selinux_file_context_verify(argv[i], 0)) {
                       printf("%s verified.\n", argv[i]);
               } else {
               ....

OK, I changed the code path as follows:

    if (!verify) {
        error += printmatchpathcon(argv[i], header);
        continue;
    }
    if (selinux_file_context_verify(argv[i], 0)) {
        printf("%s verified.\n", argv[i]);
        continue;
    }
        :

Thanks,

Signature · 1 line

KaiGai Kohei <[email protected]>

matchpathcon.c +98 -0

Index: selinux/matchpathcon.c
===================================================================
@@ -0,0 +1,98 @@
+/* matchpathcon  -  get the default security context for the specified
+ *                  path from the file contexts configuration.
+ *                  based on libselinux-1.32
+ * Port to busybox: KaiGai Kohei <[email protected]>
+ *
+ */
+#include "busybox.h"
+#include <selinux/selinux.h>
+
+static int printmatchpathcon(char *path, int header)
+{
+	char *buf;
+	int rc = matchpathcon(path, 0, &buf);
+	if (rc < 0) {
+		fprintf(stderr, "matchpathcon(%s) failed: %s\n",
+			path, strerror(errno));
+		return 1;
+	}
+	if (header)
+		printf("%s\t%s\n", path, buf);
+	else
+		printf("%s\n", buf);
+
+	freecon(buf);
+	return 0;
+}
+
+#define MATCHPATHCON_OPT_NOT_PRINT	(1<<0)	/* -n */
+#define MATCHPATHCON_OPT_NOT_TRANS	(1<<1)	/* -N */
+#define MATCHPATHCON_OPT_FCONTEXT	(1<<2)	/* -f */
+#define MATCHPATHCON_OPT_PREFIX		(1<<3)	/* -p */
+#define MATCHPATHCON_OPT_VERIFY		(1<<4)	/* -V */
+
+int matchpathcon_main(int argc, char **argv)
+{
+	int i;
+	int header = 1;
+	int verify = 0;
+	int notrans = 0;
+	int error = 0;
+	unsigned long opts;
+	char *fcontext, *prefix;
+
+	if (argc < 2)
+		bb_show_usage();
+
+	opt_complementary = "?:f--p:p--f";
+	opts = getopt32(argc, argv, "nNf:p:V", &fcontext, &prefix);
+	if (opts & MATCHPATHCON_OPT_NOT_PRINT)
+		header = 0;
+	if (opts & MATCHPATHCON_OPT_NOT_TRANS) {
+		notrans = 1;
+		set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
+	}
+	if (opts & MATCHPATHCON_OPT_FCONTEXT) {
+		if (matchpathcon_init(fcontext))
+			bb_error_msg_and_die("error while processing %s: %s",
+					     fcontext, errno ? strerror(errno) : "invalid");
+	}
+	if (opts & MATCHPATHCON_OPT_PREFIX) {
+		if (matchpathcon_init_prefix(NULL, prefix))
+			bb_error_msg_and_die("error while processing %s:  %s",
+					     prefix, errno ? strerror(errno) : "invalid");
+	}
+	if (opts & MATCHPATHCON_OPT_VERIFY)
+		verify = 1;
+
+	for (i = optind; i < argc; i++) {
+		security_context_t con;
+		int rc;
+
+		if (!verify) {
+			error += printmatchpathcon(argv[i], header);
+			continue;
+		}
+
+		if (selinux_file_context_verify(argv[i], 0)) {
+			printf("%s verified.\n", argv[i]);
+			continue;
+		}
+
+		if (notrans)
+			rc = lgetfilecon_raw(argv[i], &con);
+		else
+			rc = lgetfilecon(argv[i], &con);
+
+		if (rc >= 0) {
+			printf("%s has context %s, should be ", argv[i], con);
+			error += printmatchpathcon(argv[i], 0);
+			freecon(con);
+		} else {
+			printf("actual context unknown: %s, should be ", strerror(errno));
+			error += printmatchpathcon(argv[i], 0);
+		}
+	}
+	matchpathcon_fini();
+	return error;
+}

KaiGai Kohei

author

2007-01-25 14:44 UTC #18 lore raw

PATCH 8/8 busybox -- libselinux utilities applets

In reply to KaiGai Kohei

[8/8] busybox-libselinux-08-setenforce.patch
setenforce - modify the mode SELinux is running in Enforcing mode or Permissive.

Signed-off-by Hiroshi Shinji <[email protected]>

Signed-off-by KaiGai Kohei <[email protected]>

--
KaiGai Kohei <[email protected]>

setenforce.c +44 -0

Index: selinux/setenforce.c
===================================================================
@@ -0,0 +1,44 @@
+/*
+ * setenforce
+ *
+ * Based on libselinux 1.33.1
+ * Port to BusyBox  Hiroshi Shinji <[email protected]>
+ *
+ */
+
+#include "busybox.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <string.h>
+#include <strings.h>
+#include <selinux/selinux.h>
+
+int setenforce_main(int argc, char **argv)
+{
+	int rc = 0;
+	if (argc != 2) {
+		bb_show_usage();
+	}
+
+	if (is_selinux_enabled() <= 0) {
+		bb_error_msg("SELinux is disabled");
+		return 1;
+	}
+	if (strlen(argv[1]) == 1 && (argv[1][0] == '0' || argv[1][0] == '1')) {
+		rc = security_setenforce(atoi(argv[1]));
+	} else {
+		if (strcasecmp(argv[1], "enforcing") == 0) {
+			rc = security_setenforce(1);
+		} else if (strcasecmp(argv[1], "permissive") == 0) {
+			rc = security_setenforce(0);
+		} else
+			bb_show_usage();
+	}
+	if (rc < 0) {
+		bb_error_msg("setenforce() failed");
+		return 2;
+	}
+	return 0;
+}

KaiGai Kohei

author

2007-01-26 15:28 UTC #19 lore raw

In reply to KaiGai Kohei

It seems to me that the patch [1/8] was not delivered via SELinux-ML yet, so I try to resend it.

Was it filtered ?
I believe this patch is not a spam. :-)

Quoted 8 lines

[1/8] busybox-libselinux-01-common.patch
The common part of libselinux package
- modification of Makefile
- add '-lselinux', if CONFIG_SELINUX enabled
(It was never linked, so we could not build with SELinux
support in busybox-1.4.0)
- add selinux/Config.in and selinux/Kbuild
- add usage.h and applets.h for the series of applets

--
KaiGai Kohei <[email protected]>

Makefile +1 -0

Index: Makefile
===================================================================
@@ -442,6 +442,7 @@
 		networking/udhcp/ \
 		procps/ \
 		runit/ \
+		selinux/ \
 		shell/ \
 		sysklogd/ \
 		util-linux/ \

Makefile.flags +4 -0

Index: Makefile.flags
===================================================================
@@ -34,4 +34,8 @@
 ifeq ($(CONFIG_STATIC),y)
 LDFLAGS += -static
 endif
+
+ifeq ($(CONFIG_SELINUX),y)
+LDFLAGS += -lselinux
+endif
 #LDFLAGS += -nostdlib

Config.in +1 -0

Index: Config.in
===================================================================
@@ -485,3 +485,4 @@
 source shell/Config.in
 source sysklogd/Config.in
 source runit/Config.in
+source selinux/Config.in

Kbuild +15 -0

Index: selinux/Kbuild
===================================================================
@@ -0,0 +1,15 @@
+# Makefile for busybox
+#
+# Copyright (C) 1999-2005 by Erik Andersen <[email protected]>
+# Copyright (C) 2007 by KaiGai Kohei <[email protected]>
+#
+# Licensed under the GPL v2, see the file LICENSE in this tarball.
+
+lib-y:=
+lib-$(CONFIG_AVCSTAT)		+= avcstat.o
+lib-$(CONFIG_GETENFORCE)	+= getenforce.o
+lib-$(CONFIG_GETSEBOOL)		+= getsebool.o
+lib-$(CONFIG_MATCHPATHCON)	+= matchpathcon.o
+lib-$(CONFIG_SELINUXENABLED)	+= selinuxenabled.o
+lib-$(CONFIG_SETENFORCE)	+= setenforce.o
+lib-$(CONFIG_TOGGLESEBOOL)	+= togglesebool.o

Config.in +60 -0

60 lines not on this page · raw message

usage.h +37 -0

Index: include/usage.h
===================================================================
@@ -98,6 +98,15 @@
 #define ash_full_usage \
        "The ash shell (command interpreter)"
 
+#define avcstat_trivial_usage \
+	"[-c] [-f status_file] [interval]"
+#define avcstat_full_usage \
+	"Display SELinux AVC statistics.  If the interval parameter is specified, the\n" \
+	"program will loop, displaying updated statistics every 'interval' seconds.\n" \
+	"Relative values are displayed by default. Use the -c option to specify the\n" \
+	"display of cumulative values.  The -f option specifies the location of the\n" \
+	"AVC statistics file, defaulting to '/selinux/avc/cache_stats'."
+
 #define awk_trivial_usage \
        "[OPTION]... [program-text] [FILE ...]"
 #define awk_full_usage \

@@ -1013,6 +1022,9 @@
        "	-6	When using port/proto only search IPv6 space\n" \
        "	-SIGNAL	When used with -k, this signal will be used to kill"
 
+#define getenforce_trivial_usage
+#define getenforce_full_usage
+
 #define getopt_trivial_usage \
        "[OPTIONS]..."
 #define getopt_full_usage \

@@ -1047,6 +1059,11 @@
        " esac\n" \
        "done\n"
 
+#define getsebool_trivial_usage \
+	"-a or getsebool boolean..."
+#define getsebool_full_usage \
+	"-a     Show all SELinux booleans."
+
 #define getty_trivial_usage \
        "[OPTIONS]... baud_rate,... line [termtype]"
 #define getty_full_usage \

@@ -1896,6 +1913,15 @@
        "/dev/hda[0-15]\n"
 #endif
 
+#define matchpathcon_trivial_usage \
+	"[-n] [-N] [-f file_contexts_file] [-p prefix] [-V]"
+#define matchpathcon_full_usage \
+	"\t-n Do not display path.\n" \
+	"\t-N Do not use translations.\n" \
+	"\t-f file_context_file Use alternate file_context file\n" \
+	"\t-p prefix Use prefix to speed translations\n" \
+	"\t-V Verify file context on disk matches defaults"
+
 #define md5sum_trivial_usage \
        "[OPTION] [FILEs...]" \
 	USE_FEATURE_MD5_SHA1_SUM_CHECK("\n   or: md5sum [OPTION] -c [FILE]")

@@ -2718,6 +2744,9 @@
        "$ echo \"foo\" | sed -e 's/f[a-zA-Z]o/bar/g'\n" \
        "bar\n"
 
+#define selinuxenabled_trivial_usage
+#define selinuxenabled_full_usage
+
 #define seq_trivial_usage \
        "[first [increment]] last"
 #define seq_full_usage \

@@ -2735,6 +2764,10 @@
        "\n\nOptions:\n" \
        "	-r	Reset output to /dev/console"
 
+#define setenforce_trivial_usage \
+	"[ Enforcing | Permissive | 1 | 0 ]"
+#define setenforce_full_usage
+
 #define setkeycodes_trivial_usage \
        "SCANCODE KEYCODE ..."
 #define setkeycodes_full_usage \

@@ -3213,6 +3246,10 @@
        "\n\nOptions:\n" \
        "	-v	Display verbose resource usage information"
 
+#define togglesebool_trivial_usage \
+	"boolname1 [boolname2 ...]"
+#define togglesebool_full_usage
+
 #define top_trivial_usage \
        "[-b] [-n count] [-d seconds]"
 #define top_full_usage \

applets.h +7 -0

Index: include/applets.h
===================================================================
@@ -59,6 +59,7 @@
 USE_ARP(APPLET(arp, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_ARPING(APPLET(arping, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_ASH(APPLET_NOUSAGE(ash, ash, _BB_DIR_BIN, _BB_SUID_NEVER))
+USE_AVCSTAT(APPLET(avcstat, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_AWK(APPLET(awk, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_BASENAME(APPLET(basename, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_BBCONFIG(APPLET(bbconfig, _BB_DIR_BIN, _BB_SUID_NEVER))

@@ -133,7 +134,9 @@
 USE_FTPGET(APPLET_ODDNAME(ftpget, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpget))
 USE_FTPPUT(APPLET_ODDNAME(ftpput, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpput))
 USE_FUSER(APPLET(fuser, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_GETENFORCE(APPLET(getenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETOPT(APPLET(getopt, _BB_DIR_BIN, _BB_SUID_NEVER))
+USE_GETSEBOOL(APPLET(getsebool, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETTY(APPLET(getty, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_GREP(APPLET(grep, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_GUNZIP(APPLET(gunzip, _BB_DIR_BIN, _BB_SUID_NEVER))

@@ -187,6 +190,7 @@
 USE_LSATTR(APPLET(lsattr, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_LSMOD(APPLET(lsmod, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_UNLZMA(APPLET_ODDNAME(lzmacat, unlzma, _BB_DIR_USR_BIN, _BB_SUID_NEVER, lzmacat))
+USE_MATCHPATHCON(APPLET(matchpathcon, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_MAKEDEVS(APPLET(makedevs, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_MD5SUM(APPLET_ODDNAME(md5sum, md5_sha1_sum, _BB_DIR_USR_BIN, _BB_SUID_NEVER, md5sum))
 USE_MDEV(APPLET(mdev, _BB_DIR_SBIN, _BB_SUID_NEVER))

@@ -249,10 +253,12 @@
 USE_RUNSV(APPLET(runsv, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RUNSVDIR(APPLET(runsvdir, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RX(APPLET(rx, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_SELINUXENABLED(APPLET(selinuxenabled, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SED(APPLET(sed, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SEQ(APPLET(seq, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETARCH(APPLET(setarch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SETCONSOLE(APPLET(setconsole, _BB_DIR_SBIN, _BB_SUID_NEVER))
+USE_SETENFORCE(APPLET(setenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETKEYCODES(APPLET(setkeycodes, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETLOGCONS(APPLET(setlogcons, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETSID(APPLET(setsid, _BB_DIR_USR_BIN, _BB_SUID_NEVER))

@@ -291,6 +297,7 @@
 USE_TFTP(APPLET(tftp, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 #endif
 USE_TIME(APPLET(time, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_TOGGLESEBOOL(APPLET(togglesebool, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_TOP(APPLET(top, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_TOUCH(APPLET(touch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_TR(APPLET(tr, _BB_DIR_USR_BIN, _BB_SUID_NEVER))

James Carter

2007-01-29 17:42 UTC #20 lore raw

Quoted 5 lines · KaiGai Kohei

It seems to me that the patch [1/8] was not delivered via SELinux-ML yet, so I try to resend it.
Was it filtered ?
I believe this patch is not a spam. :-)

It doesn't seem to have ever reached majordomo.

Signature · 8 lines

James Carter <[email protected]>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Christopher J. PeBenito

2007-01-26 19:33 UTC #21 lore raw

In reply to KaiGai Kohei

Quoted 4 lines · KaiGai Kohei

[1/8] busybox-libselinux-01-common.patch
The common part of libselinux package
- modification of Makefile
- add '-lselinux', if CONFIG_SELINUX enabled

Also need -lsepol, otherwise you'll get missing symbols if you compile it static.

Signature · 9 lines

Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

KaiGai Kohei

author

2007-01-29 13:31 UTC #22 lore raw

Quoted 8 lines · Christopher J. PeBenito

Quoted 4 lines · KaiGai Kohei
[1/8] busybox-libselinux-01-common.patch
The common part of libselinux package
- modification of Makefile
- add '-lselinux', if CONFIG_SELINUX enabled
Also need -lsepol, otherwise you'll get missing symbols if you compile it static.

Thanks for your notification.
The fixed patch enables to link libsepol when CONFIG_SELINUX is enabled.

Signature · 1 line

KaiGai Kohei <[email protected]>

Makefile +1 -0

Index: Makefile
===================================================================
@@ -442,6 +442,7 @@
 		networking/udhcp/ \
 		procps/ \
 		runit/ \
+		selinux/ \
 		shell/ \
 		sysklogd/ \
 		util-linux/ \

Makefile.flags +4 -0

Index: Makefile.flags
===================================================================
@@ -34,4 +34,8 @@
 ifeq ($(CONFIG_STATIC),y)
 LDFLAGS += -static
 endif
+
+ifeq ($(CONFIG_SELINUX),y)
+LDFLAGS += -lselinux -lsepol
+endif
 #LDFLAGS += -nostdlib

Config.in +1 -0

Index: Config.in
===================================================================
@@ -485,3 +485,4 @@
 source shell/Config.in
 source sysklogd/Config.in
 source runit/Config.in
+source selinux/Config.in

Kbuild +15 -0

Index: selinux/Kbuild
===================================================================
@@ -0,0 +1,15 @@
+# Makefile for busybox
+#
+# Copyright (C) 1999-2005 by Erik Andersen <[email protected]>
+# Copyright (C) 2007 by KaiGai Kohei <[email protected]>
+#
+# Licensed under the GPL v2, see the file LICENSE in this tarball.
+
+lib-y:=
+lib-$(CONFIG_AVCSTAT)		+= avcstat.o
+lib-$(CONFIG_GETENFORCE)	+= getenforce.o
+lib-$(CONFIG_GETSEBOOL)		+= getsebool.o
+lib-$(CONFIG_MATCHPATHCON)	+= matchpathcon.o
+lib-$(CONFIG_SELINUXENABLED)	+= selinuxenabled.o
+lib-$(CONFIG_SETENFORCE)	+= setenforce.o
+lib-$(CONFIG_TOGGLESEBOOL)	+= togglesebool.o

Config.in +60 -0

60 lines not on this page · raw message

usage.h +37 -0

Index: include/usage.h
===================================================================
@@ -98,6 +98,15 @@
 #define ash_full_usage \
        "The ash shell (command interpreter)"
 
+#define avcstat_trivial_usage \
+	"[-c] [-f status_file] [interval]"
+#define avcstat_full_usage \
+	"Display SELinux AVC statistics.  If the interval parameter is specified, the\n" \
+	"program will loop, displaying updated statistics every 'interval' seconds.\n" \
+	"Relative values are displayed by default. Use the -c option to specify the\n" \
+	"display of cumulative values.  The -f option specifies the location of the\n" \
+	"AVC statistics file, defaulting to '/selinux/avc/cache_stats'."
+
 #define awk_trivial_usage \
        "[OPTION]... [program-text] [FILE ...]"
 #define awk_full_usage \

@@ -1013,6 +1022,9 @@
        "	-6	When using port/proto only search IPv6 space\n" \
        "	-SIGNAL	When used with -k, this signal will be used to kill"
 
+#define getenforce_trivial_usage
+#define getenforce_full_usage
+
 #define getopt_trivial_usage \
        "[OPTIONS]..."
 #define getopt_full_usage \

@@ -1047,6 +1059,11 @@
        " esac\n" \
        "done\n"
 
+#define getsebool_trivial_usage \
+	"-a or getsebool boolean..."
+#define getsebool_full_usage \
+	"-a     Show all SELinux booleans."
+
 #define getty_trivial_usage \
        "[OPTIONS]... baud_rate,... line [termtype]"
 #define getty_full_usage \

@@ -1896,6 +1913,15 @@
        "/dev/hda[0-15]\n"
 #endif
 
+#define matchpathcon_trivial_usage \
+	"[-n] [-N] [-f file_contexts_file] [-p prefix] [-V]"
+#define matchpathcon_full_usage \
+	"\t-n Do not display path.\n" \
+	"\t-N Do not use translations.\n" \
+	"\t-f file_context_file Use alternate file_context file\n" \
+	"\t-p prefix Use prefix to speed translations\n" \
+	"\t-V Verify file context on disk matches defaults"
+
 #define md5sum_trivial_usage \
        "[OPTION] [FILEs...]" \
 	USE_FEATURE_MD5_SHA1_SUM_CHECK("\n   or: md5sum [OPTION] -c [FILE]")

@@ -2718,6 +2744,9 @@
        "$ echo \"foo\" | sed -e 's/f[a-zA-Z]o/bar/g'\n" \
        "bar\n"
 
+#define selinuxenabled_trivial_usage
+#define selinuxenabled_full_usage
+
 #define seq_trivial_usage \
        "[first [increment]] last"
 #define seq_full_usage \

@@ -2735,6 +2764,10 @@
        "\n\nOptions:\n" \
        "	-r	Reset output to /dev/console"
 
+#define setenforce_trivial_usage \
+	"[ Enforcing | Permissive | 1 | 0 ]"
+#define setenforce_full_usage
+
 #define setkeycodes_trivial_usage \
        "SCANCODE KEYCODE ..."
 #define setkeycodes_full_usage \

@@ -3213,6 +3246,10 @@
        "\n\nOptions:\n" \
        "	-v	Display verbose resource usage information"
 
+#define togglesebool_trivial_usage \
+	"boolname1 [boolname2 ...]"
+#define togglesebool_full_usage
+
 #define top_trivial_usage \
        "[-b] [-n count] [-d seconds]"
 #define top_full_usage \

applets.h +7 -0

Index: include/applets.h
===================================================================
@@ -59,6 +59,7 @@
 USE_ARP(APPLET(arp, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_ARPING(APPLET(arping, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_ASH(APPLET_NOUSAGE(ash, ash, _BB_DIR_BIN, _BB_SUID_NEVER))
+USE_AVCSTAT(APPLET(avcstat, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_AWK(APPLET(awk, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_BASENAME(APPLET(basename, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_BBCONFIG(APPLET(bbconfig, _BB_DIR_BIN, _BB_SUID_NEVER))

@@ -133,7 +134,9 @@
 USE_FTPGET(APPLET_ODDNAME(ftpget, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpget))
 USE_FTPPUT(APPLET_ODDNAME(ftpput, ftpgetput, _BB_DIR_USR_BIN, _BB_SUID_NEVER,ftpput))
 USE_FUSER(APPLET(fuser, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_GETENFORCE(APPLET(getenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETOPT(APPLET(getopt, _BB_DIR_BIN, _BB_SUID_NEVER))
+USE_GETSEBOOL(APPLET(getsebool, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_GETTY(APPLET(getty, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_GREP(APPLET(grep, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_GUNZIP(APPLET(gunzip, _BB_DIR_BIN, _BB_SUID_NEVER))

@@ -187,6 +190,7 @@
 USE_LSATTR(APPLET(lsattr, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_LSMOD(APPLET(lsmod, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_UNLZMA(APPLET_ODDNAME(lzmacat, unlzma, _BB_DIR_USR_BIN, _BB_SUID_NEVER, lzmacat))
+USE_MATCHPATHCON(APPLET(matchpathcon, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_MAKEDEVS(APPLET(makedevs, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_MD5SUM(APPLET_ODDNAME(md5sum, md5_sha1_sum, _BB_DIR_USR_BIN, _BB_SUID_NEVER, md5sum))
 USE_MDEV(APPLET(mdev, _BB_DIR_SBIN, _BB_SUID_NEVER))

@@ -249,10 +253,12 @@
 USE_RUNSV(APPLET(runsv, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RUNSVDIR(APPLET(runsvdir, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_RX(APPLET(rx, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_SELINUXENABLED(APPLET(selinuxenabled, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SED(APPLET(sed, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SEQ(APPLET(seq, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETARCH(APPLET(setarch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SETCONSOLE(APPLET(setconsole, _BB_DIR_SBIN, _BB_SUID_NEVER))
+USE_SETENFORCE(APPLET(setenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETKEYCODES(APPLET(setkeycodes, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SETLOGCONS(APPLET(setlogcons, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETSID(APPLET(setsid, _BB_DIR_USR_BIN, _BB_SUID_NEVER))

@@ -291,6 +297,7 @@
 USE_TFTP(APPLET(tftp, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 #endif
 USE_TIME(APPLET(time, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
+USE_TOGGLESEBOOL(APPLET(togglesebool, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_TOP(APPLET(top, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_TOUCH(APPLET(touch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_TR(APPLET(tr, _BB_DIR_USR_BIN, _BB_SUID_NEVER))