[Fwd: policycoreutils patches]

PATCH In review Daniel J Walsh 3 participants 12 messages Apr 13, 2007 – Apr 24, 2007 SELinux security module

lore

Share & tools

lore

Daniel J Walsh

author

2007-04-13 12:53 UTC #0 lore raw

PATCH 1/1 [Fwd: policycoreutils patches]

Moved audit2allow to sbin to match audit2why.

Fix chcat to handle case where there are no categories.

Change fixfiles to run setfiles in quiet mode

Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.

restorecond init script does not return status properly

Fix output of restorecon.c errors to show correct error message.

audit2allow/Makefile +1 -1

@@ -1,6 +1,6 @@
 # Installation directories.
 PREFIX ?= ${DESTDIR}/usr
-BINDIR ?= $(PREFIX)/bin
+BINDIR ?= $(PREFIX)/sbin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale

scripts/chcat +10 -7

@@ -74,9 +74,11 @@
             if i not in cats:
                 cats.append(i)
 
-        new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
-        if new_serange[-1:] == ":":
-            new_serange = new_serange[:-1]
+            
+        if len(cats) > 0:
+            new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
+        else
+            new_serange = "%s-%s" % (serange[0], top[0])
             
         if add_ind:
             cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)

@@ -151,10 +153,11 @@
             if i in cats:
                 cats.remove(i)
 
-        new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
-        if new_serange[-1:] == ":":
-            new_serange = new_serange[:-1]
-        
+        if len(cats) > 0:
+            new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
+        else
+            new_serange = "%s-%s" % (serange[0], top[0])
+            
         if add_ind:
             cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
         else:

scripts/fixfiles +1 -1

@@ -138,7 +138,7 @@
     exit $?
 fi
 LogReadOnly
-${SETFILES} ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
+${SETFILES} -q ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
 exit $?
 }

scripts/genhomedircon +5 -1

@@ -26,6 +26,7 @@
 
 import sys, os, pwd, string, getopt, re
 from semanage import *;
+import selinux
 import gettext
 gettext.install('policycoreutils')

@@ -249,7 +250,10 @@
 				i = i.replace("HOME_DIR", home)
 				i = i.replace("ROLE", prefix)
 				i = i.replace("system_u", seuser)
-				ret = ret+i
+				# Validate if the generated context exists.  Some user types may not exist
+				scon = i.split()[-1]
+				if selinux.security_check_context(scon) == 0:
+					ret = ret+i
 		fd.close()
 		return ret

restorecon/restorecon.c +2 -2

@@ -336,8 +336,8 @@
 				if (!file_exist && errno == ENOENT)
 					return;
 				fprintf(stderr,
-					"%s:  error while labeling files under %s\n",
-					progname, buf);
+					"%s: %s: %s\n",
+					progname, buf, strerror(errno));
 				errors++;
 			}
 		}

restorecond/restorecond.init +1 -0

@@ -73,6 +73,7 @@
         ;;
   status)
 	status restorecond
+	RETVAL=$?
 	;;
   restart|reload)
 	restart

Stephen Smalley

2007-04-13 14:31 UTC #1 lore raw

Quoted 1 line · Daniel J Walsh

Moved audit2allow to sbin to match audit2why.

(one patch per message would be nicer)

I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.

Quoted 7 lines

Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode
Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.

Not sure I understand - what does it mean to not have a homedir file
context for a given user type? I can understand that multiple user
roles/types might share the same homedir file context, but not lacking one altogether.

Quoted 3 lines

restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.

Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Daniel J Walsh

author

2007-04-13 14:39 UTC #2 lore raw

Quoted 5 lines · Stephen Smalley

Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.

Quoted 8 lines

(one patch per message would be nicer)
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.

Then for consistency we should move audit2why to the same directory as audit2allow.

Quoted 9 lines

Quoted 8 lines
Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode
Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.

Quoted 5 lines

Not sure I understand - what does it mean to not have a homedir file
context for a given user type? I can understand that multiple user
roles/types might share the same homedir file context, but not lacking one altogether.

Example. I am about to release a policy creating a guest_t. This user will have very little privs on a system. The goal of this user type is that it will only be used for ssh accounts. So it will not have a guest_mozilla_home_t. Since it can not even use X-Windows. Currently if I had mozilla policy installed genhomedircon will try to generate file context with guest_mozilla_home_t.

Quoted 11 lines

Quoted 5 lines
restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.
Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.

That error message is misleading and happens on messages that have nothing to do " error while labeling files under".

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2007-04-13 14:49 UTC #3 lore raw

Quoted 8 lines · Daniel J Walsh

Quoted 7 lines · Stephen Smalley
Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
(one patch per message would be nicer)

Quoted 8 lines

Quoted 6 lines
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.

My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule. auditwhy in its current form is really only to help you; it isn't very useful for end users (doesn't provide enough information).

Quoted 14 lines

Quoted 9 lines
Quoted 8 lines
Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode
Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.
Quoted 5 lines
Not sure I understand - what does it mean to not have a homedir file
context for a given user type? I can understand that multiple user
roles/types might share the same homedir file context, but not lacking one altogether.

Quoted 6 lines

Example. I am about to release a policy creating a guest_t. This user will have very little privs on a system. The goal of this user type is that it will only be used for ssh accounts. So it will not have a
guest_mozilla_home_t. Since it can not even use X-Windows. Currently
if I had mozilla policy installed genhomedircon will try to generate file context with guest_mozilla_home_t.

Ok, so the user type has homedir contexts, just not all of them.

Quoted 5 lines

Quoted 5 lines
Quoted 4 lines
restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.

Quoted 8 lines

Quoted 5 lines
Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.
That error message is misleading and happens on messages that have nothing to do " error while labeling files under".

Hmm..that seems to be due to the fact that apply_spec() doesn't return its error status to the caller, so nftw() doesn't see it (and thus just proceeds). Which I suppose is what you want in some cases (e.g. skip that file and continue to the rest), but not always.

Regardless, the errors would still come from ntftw, which is the file tree walk - what kinds of errors are you seeing?

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2007-04-13 14:52 UTC #4 lore raw

Quoted 18 lines · Stephen Smalley

Quoted 8 lines · Daniel J Walsh
Quoted 7 lines · Stephen Smalley
Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
(one patch per message would be nicer)
Quoted 8 lines
Quoted 6 lines
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.

Quoted 6 lines

My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule.

...or generate a role types statement. Or tell the user that they just need to enable boolean B to allow it. Via analysis of the audit message against the policy rather than heuristics.

Quoted 49 lines

auditwhy in its current
form is really only to help you; it isn't very useful for end users (doesn't provide enough information).
Quoted 14 lines
Quoted 9 lines
Quoted 8 lines
Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode
Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.
Quoted 5 lines
Not sure I understand - what does it mean to not have a homedir file
context for a given user type? I can understand that multiple user
roles/types might share the same homedir file context, but not lacking one altogether.
Quoted 6 lines
Example. I am about to release a policy creating a guest_t. This user will have very little privs on a system. The goal of this user type is that it will only be used for ssh accounts. So it will not have a
guest_mozilla_home_t. Since it can not even use X-Windows. Currently
if I had mozilla policy installed genhomedircon will try to generate file context with guest_mozilla_home_t.
Ok, so the user type has homedir contexts, just not all of them.
Quoted 5 lines
Quoted 5 lines
Quoted 4 lines
restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.
Quoted 8 lines
Quoted 5 lines
Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.
That error message is misleading and happens on messages that have nothing to do " error while labeling files under".
Hmm..that seems to be due to the fact that apply_spec() doesn't return its error status to the caller, so nftw() doesn't see it (and thus just proceeds). Which I suppose is what you want in some cases (e.g. skip that file and continue to the rest), but not always.
Regardless, the errors would still come from ntftw, which is the file tree walk - what kinds of errors are you seeing?

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Daniel J Walsh

author

2007-04-13 15:10 UTC #5 lore raw

Quoted 23 lines · Stephen Smalley

Quoted 21 lines · Stephen Smalley
Quoted 19 lines · Daniel J Walsh
Quoted 6 lines · Stephen Smalley
Quoted 3 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
Quoted 9 lines
(one patch per message would be nicer)
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.

Quoted 9 lines

Quoted 7 lines
My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule.

Yes I agree. But for now we have two tools, in different directories. You can ignore this error and
we can drop audit2why when audit2allow has this functionality. BTW the MLS crowd use audit2why all the time, to tell if the denial is because of TE or MLS.

Quoted 52 lines

...or generate a role types statement. Or tell the user that they just need to enable boolean B to allow it. Via analysis of the audit message against the policy rather than heuristics.
Quoted 47 lines
auditwhy in its current
form is really only to help you; it isn't very useful for end users (doesn't provide enough information).
Quoted 9 lines
Quoted 9 lines
Quoted 9 lines
Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode
Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.
Quoted 8 lines
Quoted 6 lines
Not sure I understand - what does it mean to not have a homedir file
context for a given user type? I can understand that multiple user
roles/types might share the same homedir file context, but not lacking one altogether.
Example. I am about to release a policy creating a guest_t. This user will have very little privs on a system. The goal of this user type is that it will only be used for ssh accounts. So it will not have a guest_mozilla_home_t. Since it can not even use X-Windows. Currently if I had mozilla policy installed genhomedircon will try to generate file context with guest_mozilla_home_t.
Ok, so the user type has homedir contexts, just not all of them.
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.
Quoted 8 lines
Quoted 6 lines
Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.
That error message is misleading and happens on messages that have nothing to do " error while labeling files under".
Hmm..that seems to be due to the fact that apply_spec() doesn't return its error status to the caller, so nftw() doesn't see it (and thus just proceeds). Which I suppose is what you want in some cases (e.g. skip that file and continue to the rest), but not always.
Regardless, the errors would still come from ntftw, which is the file tree walk - what kinds of errors are you seeing?

I think you get this error even if you choose a directory that does not exist.

restorecon -R -v /some/nonexisting/dir
restorecon: error while labeling files under /some/nonexisting/dir

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229040

Karl MacMillan

2007-04-13 15:17 UTC #7 lore raw

In reply to Stephen Smalley

Quoted 18 lines · Stephen Smalley

Quoted 8 lines · Daniel J Walsh
Quoted 7 lines · Stephen Smalley
Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
(one patch per message would be nicer)
Quoted 8 lines
Quoted 6 lines
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.

Quoted 9 lines

My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule. auditwhy in its current form is really only to help you; it isn't very useful for end users (doesn't provide enough information).

I would like to see that as well. We have also discussed moving the setroubleshoot plugins into sepolgen to gain broader review and improved maintenance. The current audit2why only provides part of the picture (as you say), we really want to start telling users when they should relabel a file, flib a boolean, or take some action _other_ than allowing the access via allow rules of refpolicy interfaces.

Karl

Stephen Smalley

2007-04-13 15:18 UTC #6 lore raw

In reply to Daniel J Walsh

Quoted 21 lines · Daniel J Walsh

Quoted 17 lines
Quoted 17 lines
Quoted 12 lines
Quoted 9 lines
Quoted 3 lines
Fix output of restorecon.c errors to show correct error message.
Adding a ": %s" with strerror(errno) is fine, but I don't think you want to drop the existing error message altogether, as errno isn't always set properly.
That error message is misleading and happens on messages that have nothing to do " error while labeling files under".
Hmm..that seems to be due to the fact that apply_spec() doesn't return its error status to the caller, so nftw() doesn't see it (and thus just proceeds). Which I suppose is what you want in some cases (e.g. skip that file and continue to the rest), but not always.
Quoted 4 lines
Quoted 4 lines
Regardless, the errors would still come from ntftw, which is the file tree walk - what kinds of errors are you seeing?

Quoted 8 lines

I think you get this error even if you choose a directory that does not exist.
restorecon -R -v /some/nonexisting/dir
restorecon: error while labeling files under /some/nonexisting/dir
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229040

Ok, but I think you still want some prefix to handle other kinds of error messages, e.g. it would be just as confusing to see:
restorecon: /foobar: too many open files
which could happen if nftw() ran out of descriptors during the file tree walk.

So I think you want something like:
fprintf(stderr, "%s: error while traversing %s: %s", argv[0], buf,
strerror(errno));

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Karl MacMillan

2007-04-13 18:33 UTC #10 lore raw

In reply to Daniel J Walsh

Quoted 2 lines · Daniel J Walsh

Moved audit2allow to sbin to match audit2why.

I think I would rather move audit2why to bin. Both tools can run and are useful without any privilege.

Karl

Stephen Smalley

2007-04-13 18:43 UTC #8 lore raw

In reply to Karl MacMillan

Quoted 29 lines · Karl MacMillan

Quoted 18 lines · Stephen Smalley
Quoted 8 lines · Daniel J Walsh
Quoted 7 lines · Stephen Smalley
Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
(one patch per message would be nicer)
Quoted 8 lines
Quoted 6 lines
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.
Quoted 9 lines
My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule. auditwhy in its current form is really only to help you; it isn't very useful for end users (doesn't provide enough information).

Quoted 6 lines

I would like to see that as well. We have also discussed moving the setroubleshoot plugins into sepolgen to gain broader review and improved maintenance. The current audit2why only provides part of the picture (as you say), we really want to start telling users when they should relabel a file, flib a boolean, or take some action _other_ than allowing the access via allow rules of refpolicy interfaces.

Yes, although I'm not sure the heuristic/plugin model is the right one. Given the right support in libsepol, audit2allow/sepolgen should be able to search the conditional avtab for conditional rules that would have allowed the access and discover the right boolean directly from policy. For file labeling, it might be able to probe what types are accessible to the domain in question, and try to propose one.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Karl MacMillan

2007-04-13 18:50 UTC #9 lore raw

Quoted 37 lines · Stephen Smalley

Quoted 29 lines · Karl MacMillan
Quoted 18 lines · Stephen Smalley
Quoted 8 lines · Daniel J Walsh
Quoted 7 lines · Stephen Smalley
Quoted 2 lines · Daniel J Walsh
Moved audit2allow to sbin to match audit2why.
(one patch per message would be nicer)
Quoted 8 lines
Quoted 6 lines
I actually don't like having so many of the programs in /sbin or /usr/sbin, as they aren't in normal user paths and make it more painful to find the commands. And moving them can cause user confusion and/or script breakage.
Then for consistency we should move audit2why to the same directory as audit2allow.
Quoted 9 lines
My real preference would be that the audit2why functionality would be replicated (and improved) in sepolgen, and audit2allow would directly use that functionality to identify the cause of the denial as part of generating policy. Then audit2allow could directly generate refpolicy interface calls to e.g. add an attribute to a domain so that it passes some constraint, or generate a role allow rule. auditwhy in its current form is really only to help you; it isn't very useful for end users (doesn't provide enough information).
Quoted 6 lines
I would like to see that as well. We have also discussed moving the setroubleshoot plugins into sepolgen to gain broader review and improved maintenance. The current audit2why only provides part of the picture (as you say), we really want to start telling users when they should relabel a file, flib a boolean, or take some action _other_ than allowing the access via allow rules of refpolicy interfaces.

Quoted 7 lines

Yes, although I'm not sure the heuristic/plugin model is the right one. Given the right support in libsepol, audit2allow/sepolgen should be able to search the conditional avtab for conditional rules that would have allowed the access and discover the right boolean directly from policy. For file labeling, it might be able to probe what types are accessible to the domain in question, and try to propose one.

That's certainly true and I plan to explore those approaches. There are times, however, when the heuristics might give better explanations. So I think that we should plan to work on this functionality and import setroubleshoot plugins as needed. I'll work with John (the setroubleshoot author) to move over to using sepolgen at the right time.

Karl

Stephen Smalley

2007-04-24 14:04 UTC #11 lore raw

In reply to Daniel J Walsh

Quoted 6 lines · Daniel J Walsh

Moved audit2allow to sbin to match audit2why.
Fix chcat to handle case where there are no categories.
Change fixfiles to run setfiles in quiet mode

Quoted 7 lines

Change genhomedircon to verify context before setting homedir file context. This can happen if you have different user types, where one type has a homedir file context while another one does not.
restorecond init script does not return status properly
Fix output of restorecon.c errors to show correct error message.

Merged, except for the audit2allow -> /sbin change. Also added a prefix to the restorecon error message as discussed.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.