shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-08 11:27:32 +03:00
Code

selinux: add _cleanup_ concepts to SELinux label allocation

Browse Source
This commit is contained in:
Lennart Poettering 2015-09-23 19:55:49 +02:00
parent e8da24a642
commit 710a6b5017
4 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/basic/selinux-util.c
View File

@ -295,14 +295,20 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
return r; return r;
} }
void mac_selinux_free(char *label) { char* mac_selinux_free(char *label) {
#ifdef HAVE_SELINUX #ifdef HAVE_SELINUX
if (!label)
return NULL;
if (!mac_selinux_use()) if (!mac_selinux_use())
return; return NULL;
freecon((security_context_t) label); freecon((security_context_t) label);
#endif #endif
return NULL;
} }
int mac_selinux_create_file_prepare(const char *path, mode_t mode) { int mac_selinux_create_file_prepare(const char *path, mode_t mode) {

6
src/basic/selinux-util.h
View File

@ -24,6 +24,8 @@
#include <sys/socket.h> #include <sys/socket.h>
#include <stdbool.h> #include <stdbool.h>
#include "macro.h"
bool mac_selinux_use(void); bool mac_selinux_use(void);
void mac_selinux_retest(void); void mac_selinux_retest(void);
@ -36,7 +38,7 @@ int mac_selinux_apply(const char *path, const char *label);
int mac_selinux_get_create_label_from_exe(const char *exe, char **label); int mac_selinux_get_create_label_from_exe(const char *exe, char **label);
int mac_selinux_get_our_label(char **label); int mac_selinux_get_our_label(char **label);
int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *exec_label, char **label); int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *exec_label, char **label);
void mac_selinux_free(char *label); char* mac_selinux_free(char *label);
int mac_selinux_create_file_prepare(const char *path, mode_t mode); int mac_selinux_create_file_prepare(const char *path, mode_t mode);
void mac_selinux_create_file_clear(void); void mac_selinux_create_file_clear(void);
@ -45,3 +47,5 @@ int mac_selinux_create_socket_prepare(const char *label);
void mac_selinux_create_socket_clear(void); void mac_selinux_create_socket_clear(void);
int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen); int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen);
DEFINE_TRIVIAL_CLEANUP_FUNC(char*, mac_selinux_free);

6
src/core/selinux-setup.c
View File

@ -78,14 +78,14 @@ int mac_selinux_setup(bool *loaded_policy) {
before_load = now(CLOCK_MONOTONIC); before_load = now(CLOCK_MONOTONIC);
r = selinux_init_load_policy(&enforce); r = selinux_init_load_policy(&enforce);
if (r == 0) { if (r == 0) {
_cleanup_(mac_selinux_freep) char *label = NULL;
char timespan[FORMAT_TIMESPAN_MAX]; char timespan[FORMAT_TIMESPAN_MAX];
char *label;
mac_selinux_retest(); mac_selinux_retest();
/* Transition to the new context */ /* Transition to the new context */
r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label); r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
if (r < 0 || label == NULL) { if (r < 0 || !label) {
log_open(); log_open();
log_error("Failed to compute init label, ignoring."); log_error("Failed to compute init label, ignoring.");
} else { } else {
@ -94,8 +94,6 @@ int mac_selinux_setup(bool *loaded_policy) {
log_open(); log_open();
if (r < 0) if (r < 0)
log_error("Failed to transition into init label '%s', ignoring.", label); log_error("Failed to transition into init label '%s', ignoring.", label);
mac_selinux_free(label);
} }
after_load = now(CLOCK_MONOTONIC); after_load = now(CLOCK_MONOTONIC);

7
src/core/socket.c
View File

@ -1210,10 +1210,10 @@ fail:
} }
static int socket_open_fds(Socket *s) { static int socket_open_fds(Socket *s) {
_cleanup_(mac_selinux_freep) char *label = NULL;
bool know_label = false;
SocketPort *p; SocketPort *p;
int r; int r;
char *label = NULL;
bool know_label = false;
assert(s); assert(s);
@ -1327,13 +1327,10 @@ static int socket_open_fds(Socket *s) {
assert_not_reached("Unknown port type"); assert_not_reached("Unknown port type");
} }
mac_selinux_free(label);
return 0; return 0;
rollback: rollback:
socket_close_fds(s); socket_close_fds(s);
mac_selinux_free(label);
return r; return r;
} }