hal/tools fstab-sync.c,1.19,1.20

David Zeuthen david at freedesktop.org
Sun Sep 19 06:47:54 PDT 2004


Update of /cvs/hal/hal/tools
In directory gabe:/tmp/cvs-serv27334/tools

Modified Files:
	fstab-sync.c 
Log Message:
2004-09-19  David Zeuthen  <david at fubar.dk>

	* hald/hald_dbus.c: Include dbus-glib-lowlevel.h instead of dbus-glib.h
	(filter_function): Remove some debug output

	* configure.in: Check for selinux_removable_context_path in 
	libselinux

	* tools/fstab-sync.c:
	(get_removable_context):
	(fs_table_add_volume):
	(add_udi):
	(remove_udi):
	(clean): 
	Patch from Dan Walsh <dwalsh at redhat.com> to add fscontext to
	/etc/fstab for SELinux. Also removes patch that restored context
	for /etc/fstab since this is not needed.



Index: fstab-sync.c
===================================================================
RCS file: /cvs/hal/hal/tools/fstab-sync.c,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -d -r1.19 -r1.20
--- fstab-sync.c	31 Aug 2004 23:40:22 -0000	1.19
+++ fstab-sync.c	19 Sep 2004 13:47:52 -0000	1.20
@@ -59,13 +59,10 @@
 
 #include <popt.h>
 
+
 #define DBUS_API_SUBJECT_TO_CHANGE
 #include "libhal/libhal.h"
 
-#ifdef HAVE_SELINUX
-#include <selinux/selinux.h>
-#endif
-
 typedef int boolean;
 
 static boolean verbose = FALSE;
@@ -95,6 +92,48 @@
 
 #define fstab_update_debug(...) do {if (verbose) fprintf (stderr, __VA_ARGS__);} while (0)
 
+static pid_t pid;
+
+
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+
+static int get_removable_context(security_context_t *newcon)
+{
+  FILE *fp;
+  char buf[255], *ptr;
+  size_t plen;
+
+  fstab_update_debug (_("%d: selinux_removable_context_path %s\n"), pid, selinux_removable_context_path());
+  fp = fopen(selinux_removable_context_path(), "r");
+  if (!fp)
+    return -1;
+  
+  ptr = fgets_unlocked(buf, sizeof buf, fp);
+  fclose(fp);
+  
+  if (!ptr)
+    return -1;
+  plen = strlen(ptr);
+  if (buf[plen-1] == '\n') 
+    buf[plen-1] = 0;
+  
+  *newcon=strdup(buf);
+  /* If possible, check the context to catch
+     errors early rather than waiting until the
+     caller tries to use setexeccon on the context.
+     But this may not always be possible, e.g. if
+     selinuxfs isn't mounted. */
+  if (security_check_context(*newcon) && errno != ENOENT) {
+    free(*newcon);
+    *newcon = 0;
+    return -1;
+  }
+
+  fstab_update_debug (_("%d: removable context is %s\n"), pid, *newcon);  
+  return 0;
+}
+#endif
 
 /** This structure represents either a volume with a mountable filesystem
  *  or a drive that uses media without partition tables.
@@ -158,7 +197,6 @@
 } FSTable;
 
 static LibHalContext *hal_context = NULL;
-static pid_t pid;
 
 static void fs_table_line_add_field (FSTableLine *line, FSTableField *field);
 static boolean fs_table_line_is_generated (FSTableLine *line);
@@ -188,100 +226,6 @@
 static boolean clean (void);
 
 
-#ifdef HAVE_SELINUX
-/* largely based on restorecon.c in policycoreutils, GPLv2 license, Author: Dan Walsh */
-static int restore_selinux_context(char *filename)
-{
-  int retcontext=0;
-  int retval=0;
-  int errors=0;
-  security_context_t scontext;
-  security_context_t prev_context;
-  int len=strlen(filename);
-  struct stat st;
-  char path[256+1]; /* PATH_MAX */
-
-  /* 
-     Eliminate trailing /
-  */
-  if (len > 0 && filename[len-1]=='/' && (strcmp(filename,"/") != 0)) {
-    filename[len-1]=0;
-  }
-  if (lstat(filename, &st)!=0) {
-    fstab_update_debug ("%d: lstat(%s) failed: %s\n", pid, filename,strerror(errno));
-    return 1;
-  }
-  if (S_ISLNK(st.st_mode)) {
-    fstab_update_debug ("%d: Warning! %s refers to a symbolic link, not following last component.\n", pid, filename);
-    char *p = NULL, *file_sep;
-    char *tmp_path = strdup(filename);
-    if (!tmp_path) {
-      fstab_update_debug ("%d: strdup on %s failed:  %s\n", pid, filename,strerror(errno));
-      return 1;
-    }
-    file_sep = strrchr(tmp_path, '/');
-    if(file_sep)
-    {
-      *file_sep = 0;
-      file_sep++;
-      p = realpath(tmp_path, path);
-    }
-    if (!p || strlen(path) + strlen(file_sep) + 1 > 256) {
-      fstab_update_debug ("%d: realpath(%s) failed %s\n", pid, filename, strerror(errno));
-      free(tmp_path);
-      return 1;
-    }
-    sprintf(p + strlen(p), "/%s", file_sep);
-    filename = p;
-    free(tmp_path);
-  } else {
-    char *p;
-    p = realpath(filename, path);
-    if (!p) {
-      fstab_update_debug ("%d: realpath(%s) failed %s\n", pid, filename, strerror(errno));
-      return 1;
-    }
-    filename = p;
-  }
-
-  retval = matchpathcon(filename, st.st_mode, &scontext);
-  if (retval < 0) {
-    fstab_update_debug ("%d: matchpathcon(%s) failed %s\n", pid, filename,strerror(errno));
-    return 1;
-  } 
-  if (strcmp(scontext,"<<none>>")==0) {
-    freecon(scontext);
-    return 0;
-  }
-  retcontext=lgetfilecon(filename,&prev_context);
-  
-  if (retcontext >= 0 || errno == ENODATA) {
-    if (retcontext < 0 || strcmp(prev_context,scontext) != 0) {
-      retval=lsetfilecon(filename,scontext);
-      if (retval<0) {
-	  fstab_update_debug ("%d: %s set context %s->%s failed:'%s'\n",
-			      pid, PROGRAM_NAME, filename, scontext, strerror(errno));
-	  if (retcontext >= 0)
-	    freecon(prev_context);
-	  freecon(scontext);
-	  return 1;
-      } else 	
-	fstab_update_debug ("%d: %s reset context %s->%s\n",
-			    pid, PROGRAM_NAME, filename, scontext);
-    } 
-    if (retcontext >= 0)
-      freecon(prev_context);
-  } 
-  else {
-    errors++;
-    fstab_update_debug ("%d: %s get context on %s failed: '%s'\n",
-			pid, PROGRAM_NAME, filename, strerror(errno));
-  }
-  freecon(scontext);
-  return errors;
-}
-#endif /* HAVE_SELINUX */
-
 static FSTableField *
 fs_table_field_new (FSTableFieldType type, const char *value)
 {
@@ -1326,6 +1270,24 @@
   strcat_len (options, "," FSTAB_SYNC_MOUNT_MANAGED_KEYWORD);
 #endif
 
+#ifdef HAVE_SELINUX
+  if (is_selinux_enabled() > 0 ){
+    security_context_t scontext;
+
+    fstab_update_debug (_("%d: SELinux is enabled\n"), pid);
+
+    if (get_removable_context(&scontext)==0) {
+      strcat_len (options, ",fscontext=");
+      strcat_len(options, scontext);
+      freecon(scontext);
+    } else {
+      fstab_update_debug (_("%d: Could not get fscontext\n"), pid);
+    }
+  } else {
+    fstab_update_debug (_("%d: SELinux is NOT enabled\n"), pid);
+  }
+#endif
+
   if (strcmp (volume->drive_type, "cdrom") == 0)
     strcat_len (options, ",ro");
 
@@ -1538,10 +1500,6 @@
   close (fd);
   volume_free (volume);
 
-#ifdef HAVE_SELINUX
-  restore_selinux_context(_PATH_FSTAB);
-#endif
-
   return TRUE;
 
 error:
@@ -1645,10 +1603,6 @@
   free (block_device);
   fs_table_line_free (line);
 
-#ifdef HAVE_SELINUX
-  restore_selinux_context(_PATH_FSTAB);
-#endif
-
   return TRUE;
 
 error:
@@ -1786,10 +1740,6 @@
 
   close (fd);
 
-#ifdef HAVE_SELINUX
-  restore_selinux_context(_PATH_FSTAB);
-#endif
-
   syslog (LOG_INFO, _("removed all generated mount points"));
 
   return TRUE;




More information about the hal-commit mailing list