policycoreutils: fixfiles use new kernel seclabel

PATCH In review Daniel J Walsh 4 participants 6 messages Aug 3, 2011 – Aug 15, 2011 SELinux security module

lore

Share & tools

lore

Daniel J Walsh

author

2011-08-03 20:58 UTC #0 lore raw

PATCH 32/155 policycoreutils: fixfiles use new kernel seclabel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This patch looks good to me. acked.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk45tn8ACgkQrlYvE4MpobMCxgCfXH6HOZTQkP4COSovye5EM2H2 7zUAoN2kgLGrJ9Ust2zHvLNT7OHsP9fd
=iKy+
-----END PGP SIGNATURE-----

Stephen Smalley

2011-08-04 14:58 UTC #1 lore raw

Quoted 5 lines · Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch looks good to me. acked.

When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Eric Paris

Acked-by Dan Walsh

2011-08-12 18:22 UTC #2 lore raw

Quoted 7 lines · Stephen Smalley

Quoted 1 line · Daniel J Walsh
This patch looks good to me. acked.
When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel.

Patch replaced with the attached.

-Eric

From 3d39e0e30ad34500917e695a3a3f3e4f3614dc8f Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Sun, 10 Jul 2011 16:09:11 +0200
Subject: [PATCH] policycoreutils: fixfiles: use new kernel seclabel option

The kernel now outputs a mount option called 'seclabel' which indicates if the filesystem supposed security labeling. Use that instead of having to update some hard coded list of acceptable filesystems (that may or may not be acceptable depending on if they were compiled with security xattrs)

Signed-off-by Eric Paris <[email protected]>

Acked-by Dan Walsh <[email protected]>

---
 policycoreutils/scripts/fixfiles |   39 ++++++++++++++++++++++++++++++++++++-
 1 files changed, 37 insertions(+), 2 deletions(-)

policycoreutils/scripts/fixfiles +37 -2

index ba59d87..adc95fe 100755
@@ -20,6 +20,41 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
+VER=`uname -r`
+MAJOR=`echo $VER | cut -d. -f1`
+MINOR=`echo $VER | cut -d. -f2`
+MICRO=`echo $VER | cut -d. -f3`
+#
+# Get all mount points that support labeling.  Use the 'seclabel' field if it
+# is available.  Else fall back to known fs types which likely support xattrs
+# and we know were not context mounted.
+#
+get_all_labeled_mounts() {
+FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`"
+for i in $FS; do
+	if [ $MAJOR -le 2 ] && [ $MINOR -le 6 ] && [ $MICRO -lt 30 ]
+	then
+		grep " $i " /proc/self/mounts | grep -v "context=" | egrep --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i
+	else
+		grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)seclabel(,|$)' && echo $i
+	fi
+done
+}
+
+get_rw_labeled_mounts() {
+FS=`get_all_labeled_mounts | sort | uniq`
+for i in $FS; do
+	grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)rw(,|$)' && echo $i
+done
+}
+
+get_ro_labeled_mounts() {
+FS=`get_all_labeled_mounts | sort | uniq`
+for i in $FS; do
+	grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)ro(,|$)' && echo $i
+done
+}
+
 exclude_dirs_from_relabelling() {
     exclude_from_relabelling=
     if [ -e /etc/selinux/fixfiles_exclude_dirs ]

@@ -64,8 +99,8 @@ SYSLOGFLAG="-l"
 LOGGER=/usr/sbin/logger
 SETFILES=/sbin/setfiles
 RESTORECON=/sbin/restorecon
-FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';`
-FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';`
+FILESYSTEMSRW=`get_rw_labeled_mounts`
+FILESYSTEMSRO=`get_ro_labeled_mounts`
 FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
 SELINUXTYPE="targeted"
 if [ -e /etc/selinux/config ]; then

Signature · 1 line

1.7.6

Stephen Smalley

2011-08-12 18:44 UTC #3 lore raw

Quoted 10 lines · Eric Paris

Quoted 7 lines · Stephen Smalley
Quoted 1 line · Daniel J Walsh
This patch looks good to me. acked.
When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel.
Patch replaced with the attached.

Your version comparison isn't quite right, e.g. consider 2.2.30. If you want a reliable version compare, you probably want to do something similar to KERNEL_VERSION() from include/linux/version.h and convert both versions to simple integers that can be compared. Or you could do something based on this gem:
http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/

Or just rewrite fixfiles in a reasonable language ;)

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Daniel J Walsh

author

2011-08-15 10:36 UTC #4 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 14 lines · Stephen Smalley

Quoted 4 lines · Eric Paris
Quoted 1 line · Stephen Smalley
On Wed, 2011-08-03 at 16:58 -0400, Daniel J Walsh wrote:
Quoted 8 lines
Quoted 6 lines
Quoted 1 line
This patch looks good to me. acked.
When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel.
Patch replaced with the attached.

Quoted 9 lines

Your version comparison isn't quite right, e.g. consider 2.2.30. If you want a reliable version compare, you probably want to do something similar to KERNEL_VERSION() from include/linux/version.h and convert both versions to simple integers that can be compared. Or you could do something based on this gem:
http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/
Or just rewrite fixfiles in a reasonable language ;)

Or stop supporting really old versions of kernels with the latest tool chain.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5I9sAACgkQrlYvE4MpobMXqQCdHF3n5u/Yw6bHNteFU3UXOyoh i58An2VSHBmLU1dgHGuybzUiU+c0H4zc
=F4xN
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Eric Paris

Acked-by Dan Walsh

2011-08-15 15:27 UTC #5 lore raw

In reply to Stephen Smalley

Quoted 12 lines · Stephen Smalley

Quoted 10 lines · Eric Paris
Quoted 7 lines · Stephen Smalley
Quoted 1 line · Daniel J Walsh
This patch looks good to me. acked.
When similar logic was added to setfiles, we included a kernel version check (>= 2.6.30) to ensure that we didn't end up excluding all filesystems on older kernels that do not report seclabel.
Patch replaced with the attached.

Quoted 8 lines

Your version comparison isn't quite right, e.g. consider 2.2.30. If you want a reliable version compare, you probably want to do something similar to KERNEL_VERSION() from include/linux/version.h and convert both versions to simple integers that can be compared. Or you could do something based on this gem:
http://rubinium.org/blog/archives/2010/04/05/shell-script-version-compare-vercmp/
Or just rewrite fixfiles in a reasonable language ;)

Decided to go with the gem.

From 1da72eea266fdee3603204423ab1d9e68ff05f79 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Sun, 10 Jul 2011 16:09:11 +0200
Subject: [PATCH] policycoreutils: fixfiles: use new kernel seclabel option

Signed-off-by Eric Paris <[email protected]>

Acked-by Dan Walsh <[email protected]>

---
 policycoreutils/scripts/fixfiles |   48 ++++++++++++++++++++++++++++++++++++-
 1 files changed, 46 insertions(+), 2 deletions(-)

policycoreutils/scripts/fixfiles +46 -2

index ba59d87..54226eb 100755
@@ -20,6 +20,50 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
+#
+# seclabel support was added in 2.6.30.  This function will return a positive
+# number if the current kernel version is greater than 2.6.30, a negative
+# number if the current is less than 2.6.30 and 0 if they are the same.
+#
+function useseclabel {
+        VER=`uname -r`
+        SUP=2.6.30
+        expr '(' "$VER" : '\([^.]*\)' ')' '-' '(' "$SUP" : '\([^.]*\)' ')' '|' \
+             '(' "$VER.0" : '[^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0" : '[^.]*[.]\([^.]*\)' ')' '|' \
+             '(' "$VER.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')' '-' '(' "$SUP.0.0" : '[^.]*[.][^.]*[.]\([^.]*\)' ')'
+}
+
+#
+# Get all mount points that support labeling.  Use the 'seclabel' field if it
+# is available.  Else fall back to known fs types which likely support xattrs
+# and we know were not context mounted.
+#
+get_all_labeled_mounts() {
+FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`"
+for i in $FS; do
+	if [ `useseclabel` -ge 0 ]
+	then
+		grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)seclabel(,|$)' && echo $i
+	else
+		grep " $i " /proc/self/mounts | grep -v "context=" | egrep --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i
+	fi
+done
+}
+
+get_rw_labeled_mounts() {
+FS=`get_all_labeled_mounts | sort | uniq`
+for i in $FS; do
+	grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)rw(,|$)' && echo $i
+done
+}
+
+get_ro_labeled_mounts() {
+FS=`get_all_labeled_mounts | sort | uniq`
+for i in $FS; do
+	grep " $i " /proc/self/mounts | awk '{print $4}' | egrep --silent '(^|,)ro(,|$)' && echo $i
+done
+}
+
 exclude_dirs_from_relabelling() {
     exclude_from_relabelling=
     if [ -e /etc/selinux/fixfiles_exclude_dirs ]

@@ -64,8 +108,8 @@ SYSLOGFLAG="-l"
 LOGGER=/usr/sbin/logger
 SETFILES=/sbin/setfiles
 RESTORECON=/sbin/restorecon
-FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';`
-FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';`
+FILESYSTEMSRW=`get_rw_labeled_mounts`
+FILESYSTEMSRO=`get_ro_labeled_mounts`
 FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
 SELINUXTYPE="targeted"
 if [ -e /etc/selinux/config ]; then

Signature · 1 line

1.7.6