shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-22 22:03:43 +03:00
Code

mac: also rename use_{smack,selinux,apparmor}() calls so that they share the new mac_{smack,selinux,apparmor}_xyz() convention

Browse Source
This commit is contained in:
Lennart Poettering 2014-10-23 17:34:30 +02:00
parent cc56fafeeb
commit 6baa7db008
18 changed files with 58 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/condition.c
View File

@ -45,13 +45,13 @@ static bool condition_test_security(Condition *c) {
assert(c->type == CONDITION_SECURITY);
if (streq(c->parameter, "selinux"))
return use_selinux() == !c->negate;
return mac_selinux_use() == !c->negate;
if (streq(c->parameter, "smack"))
return mac_smack_use() == !c->negate;
if (streq(c->parameter, "apparmor"))
return use_apparmor() == !c->negate;
return mac_apparmor_use() == !c->negate;
if (streq(c->parameter, "ima"))
return use_ima() == !c->negate;
if (streq(c->parameter, "smack"))
return use_smack() == !c->negate;
return c->negate;
}

4
src/core/execute.c
View File

@ -1669,7 +1669,7 @@ static int exec_child(ExecCommand *command,
#endif
#ifdef HAVE_SELINUX
if (use_selinux()) {
if (mac_selinux_use()) {
if (context->selinux_context) {
err = setexeccon(context->selinux_context);
if (err < 0 && !context->selinux_context_ignore) {
@ -1697,7 +1697,7 @@ static int exec_child(ExecCommand *command,
#endif
#ifdef HAVE_APPARMOR
if (context->apparmor_profile && use_apparmor()) {
if (context->apparmor_profile && mac_apparmor_use()) {
err = aa_change_onexec(context->apparmor_profile);
if (err < 0 && !context->apparmor_profile_ignore) {
*error = EXIT_APPARMOR_PROFILE;

6
src/core/mount-setup.c
View File

@ -82,9 +82,9 @@ static const MountPoint mount_table[] = {
NULL, MNT_NONE },
#ifdef HAVE_SMACK
{ "smackfs", "/sys/fs/smackfs", "smackfs", "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
use_smack, MNT_FATAL },
mac_smack_use, MNT_FATAL },
{ "tmpfs", "/dev/shm", "tmpfs", "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
use_smack, MNT_FATAL },
mac_smack_use, MNT_FATAL },
#endif
{ "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
NULL, MNT_FATAL|MNT_IN_CONTAINER },
@ -92,7 +92,7 @@ static const MountPoint mount_table[] = {
NULL, MNT_IN_CONTAINER },
#ifdef HAVE_SMACK
{ "tmpfs", "/run", "tmpfs", "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
use_smack, MNT_FATAL },
mac_smack_use, MNT_FATAL },
#endif
{ "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
NULL, MNT_FATAL|MNT_IN_CONTAINER },

4
src/core/selinux-access.c
View File

@ -142,7 +142,7 @@ static int selinux_access_init(sd_bus_error *error) {
if (initialized)
return 0;
if (!use_selinux())
if (!mac_selinux_use())
return 0;
r = access_init();
@ -186,7 +186,7 @@ int selinux_generic_access_check(
assert(permission);
assert(error);
if (!use_selinux())
if (!mac_selinux_use())
return 0;
r = selinux_access_init(error);

2
src/core/selinux-setup.c
View File

@ -84,7 +84,7 @@ int selinux_setup(bool *loaded_policy) {
char timespan[FORMAT_TIMESPAN_MAX];
char *label;
retest_selinux();
mac_selinux_retest();
/* Transition to the new context */
r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);

2
src/journal/journald-native.c
View File

@ -417,7 +417,7 @@ int server_open_native_socket(Server*s) {
}
#ifdef HAVE_SELINUX
if (use_selinux()) {
if (mac_selinux_use()) {
one = 1;
r = setsockopt(s->native_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
if (r < 0)

2
src/journal/journald-server.c
View File

@ -680,7 +680,7 @@ static void dispatch_message_real(
}
#ifdef HAVE_SELINUX
if (use_selinux()) {
if (mac_selinux_use()) {
if (label) {
x = alloca(strlen("_SELINUX_CONTEXT=") + label_len + 1);

2
src/journal/journald-stream.c
View File

@ -395,7 +395,7 @@ static int stdout_stream_new(sd_event_source *es, int listen_fd, uint32_t revent
}
#ifdef HAVE_SELINUX
if (use_selinux()) {
if (mac_selinux_use()) {
if (getpeercon(fd, &stream->security_context) < 0 && errno != ENOPROTOOPT)
log_error("Failed to determine peer security context: %m");
}

2
src/journal/journald-syslog.c
View File

@ -457,7 +457,7 @@ int server_open_syslog_socket(Server *s) {
}
#ifdef HAVE_SELINUX
if (use_selinux()) {
if (mac_selinux_use()) {
one = 1;
r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
if (r < 0)

2
src/login/logind-user.c
View File

@ -326,7 +326,7 @@ static int user_mkdir_runtime_path(User *u) {
mkdir(p, 0700);
if (use_smack())
if (mac_smack_use())
r = asprintf(&t, "mode=0700,smackfsroot=*,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size);
else
r = asprintf(&t, "mode=0700,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size);

11
src/shared/apparmor-util.c
View File

@ -25,17 +25,16 @@
#include "fileio.h"
#include "apparmor-util.h"
static int use_apparmor_cached = -1;
bool mac_apparmor_use(void) {
static int cached_use = -1;
bool use_apparmor(void) {
if (use_apparmor_cached < 0) {
if (cached_use < 0) {
_cleanup_free_ char *p = NULL;
use_apparmor_cached =
cached_use =
read_one_line_file("/sys/module/apparmor/parameters/enabled", &p) >= 0 &&
parse_boolean(p) > 0;
}
return use_apparmor_cached;
return cached_use;
}

2
src/shared/apparmor-util.h
View File

@ -23,4 +23,4 @@
#include <stdbool.h>
bool use_apparmor(void);
bool mac_apparmor_use(void);

4
src/shared/label.c
View File

@ -25,13 +25,13 @@
int label_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
int r = 0;
if (use_selinux()) {
if (mac_selinux_use()) {
r = mac_selinux_fix(path, ignore_enoent, ignore_erofs);
if (r < 0)
return r;
}
if (use_smack()) {
if (mac_smack_use()) {
r = mac_smack_relabel_in_dev(path);
if (r < 0)
return r;

4
src/shared/mkdir-label.c
View File

@ -35,13 +35,13 @@
static int label_mkdir(const char *path, mode_t mode) {
int r;
if (use_selinux()) {
if (mac_selinux_use()) {
r = mac_selinux_mkdir(path, mode);
if (r < 0)
return r;
}
if (use_smack()) {
if (mac_smack_use()) {
r = mkdir(path, mode);
if (r < 0 && errno != EEXIST)
return -errno;

34
src/shared/selinux-util.c
View File

@ -40,24 +40,24 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free);
#define _cleanup_security_context_free_ _cleanup_(freeconp)
#define _cleanup_context_free_ _cleanup_(context_freep)
static int use_selinux_cached = -1;
static int cached_use = -1;
static struct selabel_handle *label_hnd = NULL;
#endif
bool use_selinux(void) {
bool mac_selinux_use(void) {
#ifdef HAVE_SELINUX
if (use_selinux_cached < 0)
use_selinux_cached = is_selinux_enabled() > 0;
if (cached_use < 0)
cached_use = is_selinux_enabled() > 0;
return use_selinux_cached;
return cached_use;
#else
return false;
#endif
}
void retest_selinux(void) {
void mac_selinux_retest(void) {
#ifdef HAVE_SELINUX
use_selinux_cached = -1;
cached_use = -1;
#endif
}
@ -68,7 +68,7 @@ int mac_selinux_init(const char *prefix) {
usec_t before_timestamp, after_timestamp;
struct mallinfo before_mallinfo, after_mallinfo;
if (!use_selinux())
if (!mac_selinux_use())
return 0;
if (label_hnd)
@ -156,7 +156,7 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
void mac_selinux_finish(void) {
#ifdef HAVE_SELINUX
if (!use_selinux())
if (!mac_selinux_use())
return;
if (label_hnd)
@ -172,7 +172,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
security_context_t mycon = NULL, fcon = NULL;
security_class_t sclass;
if (!use_selinux()) {
if (!mac_selinux_use()) {
*label = NULL;
return 0;
}
@ -315,7 +315,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) {
#ifdef HAVE_SELINUX
security_context_t filecon = NULL;
if (!use_selinux() || !label_hnd)
if (!mac_selinux_use() || !label_hnd)
return 0;
r = selabel_lookup_raw(label_hnd, &filecon, path, mode);
@ -341,7 +341,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) {
int mac_selinux_socket_set(const char *label) {
#ifdef HAVE_SELINUX
if (!use_selinux())
if (!mac_selinux_use())
return 0;
if (setsockcreatecon((security_context_t) label) < 0) {
@ -361,7 +361,7 @@ void mac_selinux_context_clear(void) {
#ifdef HAVE_SELINUX
PROTECT_ERRNO;
if (!use_selinux())
if (!mac_selinux_use())
return;
setfscreatecon(NULL);
@ -373,7 +373,7 @@ void mac_selinux_socket_clear(void) {
#ifdef HAVE_SELINUX
PROTECT_ERRNO;
if (!use_selinux())
if (!mac_selinux_use())
return;
setsockcreatecon(NULL);
@ -383,7 +383,7 @@ void mac_selinux_socket_clear(void) {
void mac_selinux_free(const char *label) {
#ifdef HAVE_SELINUX
if (!use_selinux())
if (!mac_selinux_use())
return;
freecon((security_context_t) label);
@ -450,7 +450,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
assert(addr);
assert(addrlen >= sizeof(sa_family_t));
if (!use_selinux() || !label_hnd)
if (!mac_selinux_use() || !label_hnd)
goto skipped;
/* Filter out non-local sockets */
@ -511,7 +511,7 @@ int mac_selinux_apply(const char *path, const char *label) {
int r = 0;
#ifdef HAVE_SELINUX
if (!use_selinux())
if (!mac_selinux_use())
return 0;
r = setfilecon(path, (char *)label);

7
src/shared/selinux-util.h
View File

@ -25,13 +25,14 @@
#include <stdio.h>
#include <stdbool.h>
bool use_selinux(void);
void retest_selinux(void);
bool mac_selinux_use(void);
void mac_selinux_retest(void);
int mac_selinux_init(const char *prefix);
int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
void mac_selinux_finish(void);
int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
int mac_selinux_socket_set(const char *label);
void mac_selinux_socket_clear(void);

18
src/shared/smack-util.c
View File

@ -27,14 +27,14 @@
#include "path-util.h"
#include "smack-util.h"
bool use_smack(void) {
bool mac_smack_use(void) {
#ifdef HAVE_SMACK
static int use_smack_cached = -1;
static int cached_use = -1;
if (use_smack_cached < 0)
use_smack_cached = access("/sys/fs/smackfs/", F_OK) >= 0;
if (cached_use < 0)
cached_use = access("/sys/fs/smackfs/", F_OK) >= 0;
return use_smack_cached;
return cached_use;
#else
return false;
#endif
@ -43,7 +43,7 @@ bool use_smack(void) {
int mac_smack_set_path(const char *path, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
if (!mac_smack_use())
return 0;
if (label)
@ -57,7 +57,7 @@ int mac_smack_set_path(const char *path, const char *label) {
int mac_smack_set_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
if (!mac_smack_use())
return 0;
return fsetxattr(fd, "security.SMACK64", label, strlen(label), 0);
@ -68,7 +68,7 @@ int mac_smack_set_fd(int fd, const char *label) {
int mac_smack_set_ip_out_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
if (!mac_smack_use())
return 0;
return fsetxattr(fd, "security.SMACK64IPOUT", label, strlen(label), 0);
@ -79,7 +79,7 @@ int mac_smack_set_ip_out_fd(int fd, const char *label) {
int mac_smack_set_ip_in_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
if (!mac_smack_use())
return 0;
return fsetxattr(fd, "security.SMACK64IPIN", label, strlen(label), 0);

2
src/shared/smack-util.h
View File

@ -28,7 +28,7 @@
#define SMACK_FLOOR_LABEL "_"
#define SMACK_STAR_LABEL "*"
bool use_smack(void);
bool mac_smack_use(void);
int mac_smack_set_path(const char *path, const char *label);
int mac_smack_set_fd(int fd, const char *label);