From: James Carter <jwcart2@gmail.com>
To: "Christian Göttsche" <cgzones@googlemail.com>
Cc: selinux@vger.kernel.org
Subject: Re: [PATCH v2] libselinux: avoid logs in get_ordered_context_list() without policy
Date: Wed, 27 Mar 2024 15:07:11 -0400 [thread overview]
Message-ID: <CAP+JOzSxEewe8HdW3RM7LZmqmsmU1xHDPVPtJt=nNer1RiEq0A@mail.gmail.com> (raw)
In-Reply-To: <CAP+JOzSdKAkRSHqN9jd=f8Thj3a316yRheExf4od90N3iQ4TTg@mail.gmail.com>
On Mon, Mar 25, 2024 at 3:10 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Fri, Mar 22, 2024 at 10:59 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
> >
> > If no policy has been loaded yet and thus the current context is still
> > "kernel" avoid logging failures in get_ordered_context_list(), like:
> >
> > get_ordered_context_list: error in processing configuration file /etc/selinux/debian/contexts/users/root
> > get_ordered_context_list: error in processing configuration file /etc/selinux/debian/contexts/default_contexts
> >
> > Move the context parsing from get_context_user() to its caller
> > get_ordered_context_list(), so an invalid context is not treated as an
> > get_context_user() failure and not logged.
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>
>
Merged.
Thanks,
Jim
> > ---
> > v2:
> > - move the context parsing from get_context_user() to its caller
> > - add Signed-off-by
> > ---
> > libselinux/src/get_context_list.c | 24 ++++++++++++------------
> > 1 file changed, 12 insertions(+), 12 deletions(-)
> >
> > diff --git a/libselinux/src/get_context_list.c b/libselinux/src/get_context_list.c
> > index 7e23be05..0ad24654 100644
> > --- a/libselinux/src/get_context_list.c
> > +++ b/libselinux/src/get_context_list.c
> > @@ -130,7 +130,7 @@ static int is_in_reachable(char **reachable, const char *usercon_str)
> > }
> >
> > static int get_context_user(FILE * fp,
> > - const char * fromcon,
> > + context_t fromcon,
> > const char * user,
> > char ***reachable,
> > unsigned int *nreachable)
> > @@ -146,7 +146,6 @@ static int get_context_user(FILE * fp,
> > char **new_reachable = NULL;
> > char *usercon_str;
> > const char *usercon_str2;
> > - context_t con;
> > context_t usercon;
> >
> > int rc;
> > @@ -155,14 +154,10 @@ static int get_context_user(FILE * fp,
> >
> > /* Extract the role and type of the fromcon for matching.
> > User identity and MLS range can be variable. */
> > - con = context_new(fromcon);
> > - if (!con)
> > - return -1;
> > - fromrole = context_role_get(con);
> > - fromtype = context_type_get(con);
> > - fromlevel = context_range_get(con);
> > + fromrole = context_role_get(fromcon);
> > + fromtype = context_type_get(fromcon);
> > + fromlevel = context_range_get(fromcon);
> > if (!fromrole || !fromtype) {
> > - context_free(con);
> > return -1;
> > }
> >
> > @@ -296,7 +291,6 @@ static int get_context_user(FILE * fp,
> > rc = 0;
> >
> > out:
> > - context_free(con);
> > free(line);
> > return rc;
> > }
> > @@ -418,6 +412,7 @@ int get_ordered_context_list(const char *user,
> > char *fname = NULL;
> > size_t fname_len;
> > const char *user_contexts_path = selinux_user_contexts_path();
> > + context_t con = NULL;
> >
> > if (!fromcon) {
> > /* Get the current context and use it for the starting context */
> > @@ -427,6 +422,10 @@ int get_ordered_context_list(const char *user,
> > fromcon = backup_fromcon;
> > }
> >
> > + con = context_new(fromcon);
> > + if (!con)
> > + goto failsafe;
> > +
> > /* Determine the ordering to apply from the optional per-user config
> > and from the global config. */
> > fname_len = strlen(user_contexts_path) + strlen(user) + 2;
> > @@ -437,7 +436,7 @@ int get_ordered_context_list(const char *user,
> > fp = fopen(fname, "re");
> > if (fp) {
> > __fsetlocking(fp, FSETLOCKING_BYCALLER);
> > - rc = get_context_user(fp, fromcon, user, &reachable, &nreachable);
> > + rc = get_context_user(fp, con, user, &reachable, &nreachable);
> >
> > fclose(fp);
> > if (rc < 0 && errno != ENOENT) {
> > @@ -451,7 +450,7 @@ int get_ordered_context_list(const char *user,
> > fp = fopen(selinux_default_context_path(), "re");
> > if (fp) {
> > __fsetlocking(fp, FSETLOCKING_BYCALLER);
> > - rc = get_context_user(fp, fromcon, user, &reachable, &nreachable);
> > + rc = get_context_user(fp, con, user, &reachable, &nreachable);
> > fclose(fp);
> > if (rc < 0 && errno != ENOENT) {
> > selinux_log(SELINUX_ERROR,
> > @@ -472,6 +471,7 @@ int get_ordered_context_list(const char *user,
> > else
> > freeconary(reachable);
> >
> > + context_free(con);
> > freecon(backup_fromcon);
> >
> > return rc;
> > --
> > 2.43.0
> >
> >
next prev parent reply other threads:[~2024-03-27 19:07 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 14:50 [PATCH v2] libselinux: avoid logs in get_ordered_context_list() without policy Christian Göttsche
2024-03-25 19:10 ` James Carter
2024-03-27 19:07 ` James Carter [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-03-22 14:56 Christian Göttsche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAP+JOzSxEewe8HdW3RM7LZmqmsmU1xHDPVPtJt=nNer1RiEq0A@mail.gmail.com' \
--to=jwcart2@gmail.com \
--cc=cgzones@googlemail.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).