1
1
mirror of https://github.com/systemd/systemd-stable.git synced 2024-10-31 07:51:08 +03:00
systemd-stable/selinux.h

140 lines
3.0 KiB
C
Raw Normal View History

#ifndef SELINUX_H
#define SELINUX_H
#ifndef USE_SELINUX
static inline void selinux_setfilecon(char *file, unsigned int mode) {}
static inline void selinux_setfscreatecon(char *file, unsigned int mode) {}
static inline void selinux_init(void) {}
static inline void selinux_restore(void) {}
#else
#include <selinux/selinux.h>
#include <stdio.h>
#include <limits.h>
#include <ctype.h>
static int selinux_enabled=-1;
static security_context_t prev_scontext=NULL;
static inline int is_selinux_running(void)
{
if (selinux_enabled == -1)
return selinux_enabled = is_selinux_enabled() > 0;
return selinux_enabled;
}
static inline int selinux_get_media(char *path, int mode, char **media)
{
FILE *fp;
char buf[PATH_MAX];
char mediabuf[PATH_MAX];
*media = NULL;
if (!(mode && S_IFBLK)) {
return -1;
}
snprintf(buf,sizeof(buf), "/proc/ide/%s/media", basename(path));
fp=fopen(buf,"r");
if (fp) {
if (fgets(mediabuf,sizeof(mediabuf), fp)) {
int size = strlen(mediabuf);
while (size-- > 0) {
if (isspace(mediabuf[size])) {
mediabuf[size]='\0';
} else {
break;
}
}
*media = strdup(mediabuf);
info("selinux_get_media(%s)->%s \n", path, *media);
}
fclose(fp);
return 0;
} else {
return -1;
}
}
static inline void selinux_setfilecon(char *file, unsigned int mode)
{
if (is_selinux_running()) {
security_context_t scontext=NULL;
char *media;
int ret=selinux_get_media(file, mode, &media);
if (ret == 0) {
ret = matchmediacon(media, &scontext);
free(media);
}
if (ret == -1)
if (matchpathcon(file, mode, &scontext) < 0) {
dbg("matchpathcon(%s) failed\n", file);
return;
}
if (setfilecon(file, scontext) < 0)
dbg("setfiles %s failed with error '%s'",
file, strerror(errno));
freecon(scontext);
}
}
static inline void selinux_setfscreatecon(char *file, unsigned int mode)
{
int retval = 0;
security_context_t scontext=NULL;
if (is_selinux_running()) {
char *media;
int ret = selinux_get_media(file, mode, &media);
if (ret == 0) {
ret = matchmediacon(media, &scontext);
free(media);
}
if (ret == -1)
if (matchpathcon(file, mode, &scontext) < 0) {
dbg("matchpathcon(%s) failed\n", file);
return;
}
retval = setfscreatecon(scontext);
if (retval < 0)
dbg("setfiles %s failed with error '%s'",
file, strerror(errno));
freecon(scontext);
}
}
static inline void selinux_init(void)
{
/*
* record the present security context, for file-creation
* restoration creation purposes.
*/
if (is_selinux_running()) {
if (getfscreatecon(&prev_scontext) < 0) {
dbg("getfscreatecon failed\n");
}
prev_scontext = NULL;
}
}
static inline void selinux_restore(void)
{
if (is_selinux_running()) {
/* reset the file create context to its former glory */
if (setfscreatecon(prev_scontext) < 0)
dbg("setfscreatecon failed\n");
if (prev_scontext) {
freecon(prev_scontext);
prev_scontext = NULL;
}
}
}
#endif /* USE_SELINUX */
#endif /* SELINUX_H */