From patchwork Tue Sep 6 13:48:21 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gary Tierney X-Patchwork-Id: 9316965 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1D965601C0 for ; Tue, 6 Sep 2016 13:53:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 02D7D28D33 for ; Tue, 6 Sep 2016 13:53:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EB96928D95; Tue, 6 Sep 2016 13:53:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=0.5 required=2.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_SORBS_SPAM autolearn=no version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A675F28D33 for ; Tue, 6 Sep 2016 13:53:53 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.30,291,1470700800"; d="scan'208";a="17262868" IronPort-PHdr: =?us-ascii?q?9a23=3AV0qp8x2HFv0U5x/dsmDT+DRfVm0co7zxezQtwd8Z?= =?us-ascii?q?segRKfad9pjvdHbS+e9qxAeQG96KsrQZ2qGJ6+igATVGusfZ9ihaMdRlbFwssY?= =?us-ascii?q?0uhQsuAcqIWwXQDcXBSGgEJvlET0Jv5HqhMEJYS47UblzWpWCuv3ZJQk2sfTR8?= =?us-ascii?q?Kum9IIPOlcP/j7n0oMyKJVgZz2XlKfMqdVPt/F2X7pFXyaJZaY8JgiPTpXVJf+?= =?us-ascii?q?kEjUhJHnm02yjG28Gr4ZR4+D5Rsf9yv+RJUKH9YrhqBecAVGduDnoxrPHPmVGD?= =?us-ascii?q?CFLXpyhUbmJDiRdMAg7Y/DnmT5zxtW38reM71y6EbuPsSrVhdj24/u9XSRLyji?= =?us-ascii?q?oWf2o2+XvGzNBxgbhdrQOJqBlvhYXTZdfGZ7JFYqrBcIZCFiJ6VcFLWnkEW9ux?= X-IPAS-Result: =?us-ascii?q?A2FdBAB7yc5X/wHyM5BbAhsBAQEDAQEBFwEBBAEBgw4BAQE?= =?us-ascii?q?BAR6BU7owIIddTAEBAQEBAQEBAgECWyeCMgQDEwWCEQIEAQIkExQgDgMJAQEXI?= =?us-ascii?q?QgICAMBLQsKEQ4LBRgEiA4BAxcEpAKUIAGEIx6GEYcRgU8RAWQLhQkFjiWLLoF?= =?us-ascii?q?kjVSJcoVjApBGVIJfG4FOb4RKeIEnAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 06 Sep 2016 13:53:51 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u86DrlUw007267; Tue, 6 Sep 2016 09:53:49 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u86DrkCR035159 for ; Tue, 6 Sep 2016 09:53:46 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u86DrjD0007265 for ; Tue, 6 Sep 2016 09:53:45 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1DqBAAJys5Xhw8P49RbAhoBAQEBAgEBAQGDLQEBAQEBgXGkegSRKIQRhhwCgVhMAQIBAQEBAQITAQEBCA0JCRmFEQIBAydSEDkYPBsZiC8BAxukApQgAYNyAQEBBycehhGHEYJFC4UJBY4liy6BZI1Uj1UCkEaDMxEKgU5vhEqCHwEBAQ X-IPAS-Result: A1DqBAAJys5Xhw8P49RbAhoBAQEBAgEBAQGDLQEBAQEBgXGkegSRKIQRhhwCgVhMAQIBAQEBAQITAQEBCA0JCRmFEQIBAydSEDkYPBsZiC8BAxukApQgAYNyAQEBBycehhGHEYJFC4UJBY4liy6BZI1Uj1UCkEaDMxEKgU5vhEqCHwEBAQ X-IronPort-AV: E=Sophos;i="5.30,291,1470715200"; d="scan'208";a="5686215" Received: from emsm-gh1-uea10.corp.nsa.gov (HELO emsm-gh1-uea10.nsa.gov) ([10.208.41.36]) by goalie.tycho.ncsc.mil with ESMTP; 06 Sep 2016 09:53:45 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AnN7d6xH4/Cj6fg8fRbs2M51GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ75osSwAkXT6L1XgUPTWs2DsrQf2rOQ7vGrBjRIoc7Y9itTKNoUD15NoP?= =?us-ascii?q?5VtjRoONSCB0z/IayiRA0BN+MGamVY+WqmO1NeAsf0ag6aiHSz6TkPBke3blIt?= =?us-ascii?q?dazLE4Lfx/66y/q1s8WKJV4Z3XzgMPgtdF329VyX7ZhOx9M6a+4Y8VjgmjNwYe?= =?us-ascii?q?NYxGdldxq4vi3XwYOOxqNl6DlaoPk79sRNAu3QdqU8SqFEXnx9azhmrJ6jiR6W?= =?us-ascii?q?VgaL530BQk0KgxFIBE7D9xi8UZDv4QXgse8o9yCALIXKTL0uXzmzp/NkQQX5zj?= =?us-ascii?q?sGOiQ//XD/hclgyqlcpUTy9FRE34fIbdTNZ7JFdaTHcIZCSA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0FmBAB7yc5Xhw8P49RbAhoBAQEBAgEBA?= =?us-ascii?q?QEXBoMQAQEBAQGBcaR6BJEohBGGHAKBWEwBAQEBAQEBAQIBAhABAQEIDQkJGS+?= =?us-ascii?q?CMhiCGAIBAydSEDkYPBsZiC8BAxukApQgAYNyAQEBBycehhGHEYJFC4UJBY4li?= =?us-ascii?q?y6BZI1Uj1UCkEaDMxEKgU5vhEqCHwEBAQ?= X-IPAS-Result: =?us-ascii?q?A0FmBAB7yc5Xhw8P49RbAhoBAQEBAgEBAQEXBoMQAQEBAQG?= =?us-ascii?q?BcaR6BJEohBGGHAKBWEwBAQEBAQEBAQIBAhABAQEIDQkJGS+CMhiCGAIBAydSE?= =?us-ascii?q?DkYPBsZiC8BAxukApQgAYNyAQEBBycehhGHEYJFC4UJBY4liy6BZI1Uj1UCkEa?= =?us-ascii?q?DMxEKgU5vhEqCHwEBAQ?= X-IronPort-AV: E=Sophos;i="5.30,291,1470700800"; d="scan'208";a="17262854" Received: from mout.gmx.net ([212.227.15.15]) by emsm-gh1-uea10.nsa.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Sep 2016 13:53:44 +0000 Received: from home ([79.71.36.116]) by mail.gmx.com (mrgmx001) with ESMTPA (Nemesis) id 0Lug4m-1az6Ij40Om-00zkZQ; Tue, 06 Sep 2016 15:48:42 +0200 From: Gary Tierney To: selinux@tycho.nsa.gov Subject: [PATCH] genhomedircon: remove hardcoded refpolicy strings Date: Tue, 6 Sep 2016 14:48:21 +0100 Message-Id: <1473169701-9179-2-git-send-email-gary.tierney@gmx.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1473169701-9179-1-git-send-email-gary.tierney@gmx.com> References: <1473169701-9179-1-git-send-email-gary.tierney@gmx.com> X-Provags-ID: V03:K0:M/WyMa0FzLmv1SJIGU4ADjvaYcD6vebQ1Ji/gNwteTkPHHvT454 iJjq+++0B7o4yu5Q0OIgAwpRokTyohgVTDYa0QE7lBfOhGcDtbq3l9h+K6h3lbE16tmJfmh za2YsvvmOMNtRHmo+5VGODPd7S/JbwM+oFKA5DEi/VveAe/Lvbl3FeP6K3OSy0xQoqjBVK4 qmH30IzntTJwNUPlxPmzQ== X-UI-Out-Filterresults: notjunk:1; V01:K0:yxLCalGLGTc=:Znm0jFc60tjFI6A5AYpRc9 oNc1RkGU2ujzBatT4gUonn2YM711sbkU883sm5tipJHuofKn0HG9OouC+nJTixUvp/91jRD04 7YVABFxL4Ka6Q3cclQQh0atByp3bCZ235TznHujdpwcxZL02Z17MHd4bdSAE5l5PZYlYGF34n T8hVhfeuNQUdW0mqm+C1v2n9+kV9PWIqta/bA9ge4QTWWPIZbrjbFWD5EWEZ5ZRexw//mFt7c gMIg8bOioIu71vLZ8n53cRcIFW1qYBmIyRxYBjUcbtB0u3oDgEhHQi7J05tIaAPVlR8m14AVi aGNU0xxb9nARWytZ7gl9H6qkh146+DK41zVRJ4dF6qcywP78KcmwsP2b6Si2OEwGWTHF5a+rv EUuaEvSML/7dSmNrA+enkpUMUwZ0thNnqNyz+vDt7aO0+c4iO8OL2zC985Dg2UGg0NfvmVVRv B2AQtXgw6UlOvu9GL+saOZA/fYxsTARE56cILyPN3I0YxxyqoWG3oNSoiQoVhb9nWyNaES6V8 xC/X7RsTsTkAugrVGGB+Lk0C2RcibORlMdt+2egNanc+8Mwj+JOM+uNRFm6civXjFprx07KhK RISf8uUBypMe7jLF1JVmlQqWutg8VJhA2SjrRB4PkkMk9ZTVUyDIZpZ9C0/kghlUtITuxG1NE jmz6ZhncXdIKb7XLlRzb5OjXYxS8QW1myOJKb2k19L115XDXOzQlyBJWUKSvs81KvWCesMUd/ 9GokFXnnPSHv4E/Rjsy/aGuQQIx8X17nPAv97rCasHbrg/ZluvtKBCi6z/A= X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Removes the "system_u" and "s0" string literals from refpolicy and replaces the seuser and range in each homedir, uid, and username context specification for every user. Signed-off-by: Gary Tierney --- libsemanage/src/genhomedircon.c | 79 ++++++++++++++++++++++++++++++++++------- 1 file changed, 66 insertions(+), 13 deletions(-) diff --git a/libsemanage/src/genhomedircon.c b/libsemanage/src/genhomedircon.c index cce3884..cca97f6 100644 --- a/libsemanage/src/genhomedircon.c +++ b/libsemanage/src/genhomedircon.c @@ -20,6 +20,7 @@ * 02110-1301 USA */ +#include #include #include #include @@ -82,9 +83,6 @@ #define TEMPLATE_USERNAME "%{USERNAME}" #define TEMPLATE_USERID "%{USERID}" -#define TEMPLATE_SEUSER "system_u" -#define TEMPLATE_LEVEL "s0" - #define FALLBACK_SENAME "user_u" #define FALLBACK_PREFIX "user" #define FALLBACK_LEVEL "s0" @@ -92,6 +90,8 @@ #define FALLBACK_UIDGID "[0-9]+" #define DEFAULT_LOGIN "__default__" +#define CONTEXT_NONE "<>" + typedef struct user_entry { char *name; char *uid; @@ -599,14 +599,72 @@ static int write_replacements(genhomedircon_settings_t * s, FILE * out, return STATUS_ERR; } +static int write_user_replacements(genhomedircon_settings_t *s, FILE *out, + semanage_list_t *tpl, const replacement_pair_t *repl, + const genhomedircon_user_entry_t *user) +{ + Ustr *line = USTR_NULL; + context_t context = NULL; + + for (; tpl; tpl = tpl->next) { + line = replace_all(tpl->data, repl); + if (!line) { + goto fail; + } + + const char *old_context_str = extract_context(line); + if (!old_context_str) { + goto fail; + } + + if (strcmp(old_context_str, CONTEXT_NONE) == 0) { + if (check_line(s, line) && + !ustr_io_putfileline(&line, out)) { + goto fail; + } + + continue; + } + + context = context_new(old_context_str); + if (!context) { + goto fail; + } + + if (context_user_set(context, user->sename) != 0 || + context_range_set(context, user->level) != 0) { + goto fail; + } + + const char *new_context_str = context_str(context); + if (!ustr_replace_cstr(&line, old_context_str, + new_context_str, 1)) { + goto fail; + } + + if (check_line(s, line) == STATUS_SUCCESS) { + if (!ustr_io_putfileline(&line, out)) { + goto fail; + } + } + + ustr_sc_free(&line); + context_free(context); + } + + return STATUS_SUCCESS; +fail: + ustr_sc_free(&line); + context_free(context); + return STATUS_ERR; +} + static int write_home_dir_context(genhomedircon_settings_t * s, FILE * out, semanage_list_t * tpl, const genhomedircon_user_entry_t *user) { replacement_pair_t repl[] = { - {.search_for = TEMPLATE_SEUSER,.replace_with = user->sename}, {.search_for = TEMPLATE_HOME_DIR,.replace_with = user->home}, {.search_for = TEMPLATE_ROLE,.replace_with = user->prefix}, - {.search_for = TEMPLATE_LEVEL,.replace_with = user->level}, {NULL, NULL} }; @@ -618,7 +676,7 @@ static int write_home_dir_context(genhomedircon_settings_t * s, FILE * out, return STATUS_ERR; } - return write_replacements(s, out, tpl, repl); + return write_user_replacements(s, out, tpl, repl, user); } static int write_home_root_context(genhomedircon_settings_t * s, FILE * out, @@ -640,11 +698,10 @@ static int write_username_context(genhomedircon_settings_t * s, FILE * out, {.search_for = TEMPLATE_USERNAME,.replace_with = user->name}, {.search_for = TEMPLATE_USERID,.replace_with = user->uid}, {.search_for = TEMPLATE_ROLE,.replace_with = user->prefix}, - {.search_for = TEMPLATE_SEUSER,.replace_with = user->sename}, {NULL, NULL} }; - return write_replacements(s, out, tpl, repl); + return write_user_replacements(s, out, tpl, repl, user); } static int write_user_context(genhomedircon_settings_t * s, FILE * out, @@ -653,11 +710,10 @@ static int write_user_context(genhomedircon_settings_t * s, FILE * out, replacement_pair_t repl[] = { {.search_for = TEMPLATE_USER,.replace_with = user->name}, {.search_for = TEMPLATE_ROLE,.replace_with = user->prefix}, - {.search_for = TEMPLATE_SEUSER,.replace_with = user->sename}, {NULL, NULL} }; - return write_replacements(s, out, tpl, repl); + return write_user_replacements(s, out, tpl, repl, user); } static int seuser_sort_func(const void *arg1, const void *arg2) @@ -1074,9 +1130,6 @@ static genhomedircon_user_entry_t *get_users(genhomedircon_settings_t * s, if (strcmp(name, DEFAULT_LOGIN) == 0) continue; - if (strcmp(name, TEMPLATE_SEUSER) == 0) - continue; - /* find the user structure given the name */ u = bsearch(seuname, user_list, nusers, sizeof(semanage_user_t *), (int (*)(const void *, const void *))