3 * ( [ -c ] [ -r role ] [-t type] [ -u user ] [ -l levelrange ] )
4 * command [arg1 [arg2 ...] ]
6 * attempt to run the specified command with the specified context.
8 * -r role : use the current context with the specified role
9 * -t type : use the current context with the specified type
10 * -u user : use the current context with the specified user
11 * -l level : use the current context with the specified level range
12 * -c : compute process transition context before modifying
14 * Contexts are interpreted as follows:
23 * 4 Y user:role:type:range
26 * Port to busybox: KaiGai Kohei <kaigai@kaigai.gr.jp>
27 * - based on coreutils-5.97 (in Fedora Core 6)
30 #include <selinux/context.h>
31 #include <selinux/flask.h>
35 static context_t runcon_compute_new_context(char *user, char *role, char *type, char *range,
36 char *command, int compute_trans)
39 security_context_t cur_context;
41 if (getcon(&cur_context))
42 bb_error_msg_and_die("cannot get current context");
45 security_context_t file_context, new_context;
47 if (getfilecon(command, &file_context) < 0)
48 bb_error_msg_and_die("cannot retrieve attributes of '%s'",
50 if (security_compute_create(cur_context, file_context,
51 SECCLASS_PROCESS, &new_context))
52 bb_error_msg_and_die("unable to compute a new context");
53 cur_context = new_context;
56 con = context_new(cur_context);
58 bb_error_msg_and_die("'%s' is not a valid context", cur_context);
59 if (user && context_user_set(con, user))
60 bb_error_msg_and_die("failed to set new user '%s'", user);
61 if (type && context_type_set(con, type))
62 bb_error_msg_and_die("failed to set new type '%s'", type);
63 if (range && context_range_set(con, range))
64 bb_error_msg_and_die("failed to set new range '%s'", range);
65 if (role && context_role_set(con, role))
66 bb_error_msg_and_die("failed to set new role '%s'", role);
71 #if ENABLE_FEATURE_RUNCON_LONG_OPTIONS
72 static const struct option runcon_options[] = {
73 { "user", 1, NULL, 'u' },
74 { "role", 1, NULL, 'r' },
75 { "type", 1, NULL, 't' },
76 { "range", 1, NULL, 'l' },
77 { "compute", 0, NULL, 'c' },
78 { "help", 0, NULL, 'h' },
83 #define OPTS_ROLE (1<<0) /* r */
84 #define OPTS_TYPE (1<<1) /* t */
85 #define OPTS_USER (1<<2) /* u */
86 #define OPTS_RANGE (1<<3) /* l */
87 #define OPTS_COMPUTE (1<<4) /* c */
88 #define OPTS_HELP (1<<5) /* h */
89 #define OPTS_CONTEXT_COMPONENT (OPTS_ROLE | OPTS_TYPE | OPTS_USER | OPTS_RANGE)
91 int runcon_main(int argc, char **argv);
92 int runcon_main(int argc, char **argv)
104 #if ENABLE_FEATURE_RUNCON_LONG_OPTIONS
105 applet_long_options = runcon_options;
107 opt_complementary = "-1";
108 opts = getopt32(argc, argv, "r:t:u:l:ch", &role, &type, &user, &range);
111 if (!(opts & OPTS_CONTEXT_COMPONENT)) {
114 bb_error_msg_and_die("no command given");
118 con = context_new(context);
120 bb_error_msg_and_die("'%s' is not a valid context", context);
122 con = runcon_compute_new_context(user, role, type, range,
123 argv[0], opts & OPTS_COMPUTE);
126 if (security_check_context(context_str(con)))
127 bb_error_msg_and_die("'%s' is not a valid context",
130 if (setexeccon(context_str(con)))
131 bb_error_msg_and_die("cannot set up security context '%s'",
134 execvp(argv[0], argv);
136 bb_perror_msg_and_die("cannot execute '%s'", argv[0]);