X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=selinux%2Fsetfiles.c;h=c974c4a9d4e00aa344dbe0f9d61c423c98635cad;hb=51aa861843002e92b605be840460e7141d4d86a2;hp=352c0f22496ee8fa30502d7c0403da525faebfac;hpb=972fa099e6b830f7888adf5882ebad6530369b0a;p=oweals%2Fbusybox.git diff --git a/selinux/setfiles.c b/selinux/setfiles.c index 352c0f224..c974c4a9d 100644 --- a/selinux/setfiles.c +++ b/selinux/setfiles.c @@ -4,6 +4,46 @@ Port to BusyBox (c) 2007 by Yuichi Nakamura */ +//usage:#define setfiles_trivial_usage +//usage: "[-dnpqsvW] [-e DIR]... [-o FILE] [-r alt_root_path]" +//usage: IF_FEATURE_SETFILES_CHECK_OPTION( +//usage: " [-c policyfile] spec_file" +//usage: ) +//usage: " pathname" +//usage:#define setfiles_full_usage "\n\n" +//usage: "Reset file contexts under pathname according to spec_file\n" +//usage: IF_FEATURE_SETFILES_CHECK_OPTION( +//usage: "\n -c FILE Check the validity of the contexts against the specified binary policy" +//usage: ) +//usage: "\n -d Show which specification matched each file" +//usage: "\n -l Log changes in file labels to syslog" +//usage: "\n -n Don't change any file labels" +//usage: "\n -q Suppress warnings" +//usage: "\n -r DIR Use an alternate root path" +//usage: "\n -e DIR Exclude DIR" +//usage: "\n -F Force reset of context to match file_context for customizable files" +//usage: "\n -o FILE Save list of files with incorrect context" +//usage: "\n -s Take a list of files from stdin (instead of command line)" +//usage: "\n -v Show changes in file labels, if type or role are changing" +//usage: "\n -vv Show changes in file labels, if type, role, or user are changing" +//usage: "\n -W Display warnings about entries that had no matching files" +//usage: +//usage:#define restorecon_trivial_usage +//usage: "[-iFnRv] [-e EXCLUDEDIR]... [-o FILE] [-f FILE]" +//usage:#define restorecon_full_usage "\n\n" +//usage: "Reset security contexts of files in pathname\n" +//usage: "\n -i Ignore files that don't exist" +//usage: "\n -f FILE File with list of files to process" +//usage: "\n -e DIR Directory to exclude" +//usage: "\n -R,-r Recurse" +//usage: "\n -n Don't change any file labels" +//usage: "\n -o FILE Save list of files with incorrect context" +//usage: "\n -v Verbose" +//usage: "\n -vv Show changed labels" +//usage: "\n -F Force reset of context to match file_context" +//usage: "\n for customizable files, or the user section," +//usage: "\n if it has changed" + #include "libbb.h" #if ENABLE_FEATURE_SETFILES_CHECK_OPTION #include @@ -35,8 +75,7 @@ struct globals { dev_t dev_id; /* Device id where target file exists */ int nerr; struct edir excludeArray[MAX_EXCLUDES]; -}; - +} FIX_ALIASING; #define G (*(struct globals*)&bb_common_bufsiz1) void BUG_setfiles_globals_too_big(void); #define INIT_G() do { \ @@ -99,7 +138,7 @@ enum { #define FLAG_R (option_mask32 & OPT_R) -static void qprintf(const char *fmt, ...) +static void qprintf(const char *fmt UNUSED_PARAM, ...) { /* quiet, do nothing */ } @@ -112,14 +151,13 @@ static void inc_err(void) } } -static void add_exclude(const char *const directory) +static void add_exclude(const char *directory) { struct stat sb; size_t len; if (directory == NULL || directory[0] != '/') { bb_error_msg_and_die("full path required for exclude: %s", directory); - } if (lstat(directory, &sb)) { bb_error_msg("directory \"%s\" not found, ignoring", directory); @@ -189,7 +227,7 @@ static int match(const char *name, struct stat *sb, char **con) file_sep = strrchr(tmp_path, '/'); if (file_sep == tmp_path) { file_sep++; - p[0] = '\0'; + path[0] = '\0'; p = path; } else if (file_sep) { *file_sep++ = '\0'; @@ -213,7 +251,6 @@ static int match(const char *name, struct stat *sb, char **con) name = path; if (excludeCtr > 0 && exclude(name)) goto err; - } else { char *p; p = realpath(name, path); @@ -264,36 +301,29 @@ static bool only_changed_user(const char *a, const char *b) static int restore(const char *file) { - char *my_file = xstrdup(file); - char *my_file_orig = my_file; + char *my_file; struct stat my_sb; int i, j, ret; char *context = NULL; char *newcon = NULL; bool user_only_changed = 0; - size_t len = strlen(my_file); int retval = 0; - /* Skip the extra slashes at the beginning and end, if present. */ - if (file[0] == '/' && file[1] == '/') - my_file++; - if (len > 1 && my_file[len - 1] == '/') - my_file[len - 1] = '\0'; + my_file = bb_simplify_path(file); i = match(my_file, &my_sb, &newcon); if (i < 0) /* No matching specification. */ goto out; - if (FLAG_p_progress) { count++; if (count % 0x400 == 0) { /* every 1024 times */ count = (count % (80*0x400)); if (count == 0) - fputc('\n', stdout); - fputc('*', stdout); - fflush(stdout); + bb_putchar('\n'); + bb_putchar('*'); + fflush_all(); } } @@ -354,7 +384,7 @@ static int restore(const char *file) * same. For "-vv", emit everything. */ if (verbose > 1 || !user_only_changed) { bb_info_msg("%s: reset %s context %s->%s", - applet_name, my_file, context ?: "", newcon); + applet_name, my_file, context ? context : "", newcon); } } @@ -386,7 +416,7 @@ static int restore(const char *file) out: freecon(context); freecon(newcon); - free(my_file_orig); + free(my_file); return retval; err: retval--; /* -1 */ @@ -398,8 +428,11 @@ static int restore(const char *file) * This function is called by recursive_action on each file during * the directory traversal. */ -static int apply_spec(const char *file, - struct stat *sb, void *userData, int depth) +static int FAST_FUNC apply_spec( + const char *file, + struct stat *sb, + void *userData UNUSED_PARAM, + int depth UNUSED_PARAM) { if (!follow_mounts) { /* setfiles does not process across different mount points */ @@ -416,7 +449,7 @@ static int apply_spec(const char *file, static int canoncon(const char *path, unsigned lineno, char **contextp) { - static const char err_msg[] = "%s: line %u has invalid context %s"; + static const char err_msg[] ALIGN1 = "%s: line %u has invalid context %s"; char *tmpcon; char *context = *contextp; @@ -464,10 +497,11 @@ static int process_one(char *name) if (S_ISDIR(sb.st_mode) && recurse) { if (recursive_action(name, - ACTION_RECURSE, - apply_spec, - apply_spec, - NULL, 0) != TRUE) { + ACTION_RECURSE, + apply_spec, + apply_spec, + NULL, 0) != TRUE + ) { bb_error_msg("error while labeling %s", name); goto err; } @@ -493,13 +527,12 @@ static int process_one(char *name) goto out; } -int setfiles_main(int argc, char **argv); -int setfiles_main(int argc, char **argv) +int setfiles_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; +int setfiles_main(int argc UNUSED_PARAM, char **argv) { struct stat sb; int rc, i = 0; const char *input_filename = NULL; - int use_input_file = 0; char *buf = NULL; size_t buf_len; int flags; @@ -545,29 +578,30 @@ int setfiles_main(int argc, char **argv) opt_complementary = "e::vv:v--p:p--v:v--q:q--v"; /* Option order must match OPT_x definitions! */ if (applet_name[0] == 'r') { /* restorecon */ - flags = getopt32(argc, argv, "de:f:ilnpqrsvo:FWR", + flags = getopt32(argv, "de:f:ilnpqrsvo:FWR", &exclude_dir, &input_filename, &out_filename, &verbose); } else { /* setfiles */ - flags = getopt32(argc, argv, "de:f:ilnpqr:svo:FW" - USE_FEATURE_SETFILES_CHECK_OPTION("c:"), + flags = getopt32(argv, "de:f:ilnpqr:svo:FW" + IF_FEATURE_SETFILES_CHECK_OPTION("c:"), &exclude_dir, &input_filename, &rootpath, &out_filename, - USE_FEATURE_SETFILES_CHECK_OPTION(&policyfile,) + IF_FEATURE_SETFILES_CHECK_OPTION(&policyfile,) &verbose); } + argv += optind; #if ENABLE_FEATURE_SETFILES_CHECK_OPTION if ((applet_name[0] == 's') && (flags & OPT_c)) { FILE *policystream; - policystream = xfopen(policyfile, "r"); + policystream = xfopen_for_read(policyfile); if (sepol_set_policydb_from_file(policystream) < 0) { bb_error_msg_and_die("sepol_set_policydb_from_file on %s", policyfile); } fclose(policystream); /* Only process the specified file_contexts file, not - any .homedirs or .local files, and do not perform - context translations. */ + * any .homedirs or .local files, and do not perform + * context translations. */ set_matchpathcon_flags(MATCHPATHCON_BASEONLY | MATCHPATHCON_NOTRANS | MATCHPATHCON_VALIDATE); @@ -580,7 +614,7 @@ int setfiles_main(int argc, char **argv) if (flags & OPT_o) { outfile = stdout; if (NOT_LONE_CHAR(out_filename, '-')) { - outfile = xfopen(out_filename, "w"); + outfile = xfopen_for_write(out_filename); } } if (applet_name[0] == 'r') { /* restorecon */ @@ -591,42 +625,37 @@ int setfiles_main(int argc, char **argv) rootpathlen = strlen(rootpath); } if (flags & OPT_s) { - use_input_file = 1; input_filename = "-"; add_assoc = 0; } if (applet_name[0] == 's') { /* setfiles */ /* Use our own invalid context checking function so that - we can support either checking against the active policy or - checking against a binary policy file. */ + * we can support either checking against the active policy or + * checking against a binary policy file. */ set_matchpathcon_canoncon(&canoncon); - if (argc == 1) + if (!argv[0]) bb_show_usage(); - if (stat(argv[optind], &sb) < 0) { - bb_perror_msg_and_die("%s", argv[optind]); - } + xstat(argv[0], &sb); if (!S_ISREG(sb.st_mode)) { - bb_error_msg_and_die("spec file %s is not a regular file", argv[optind]); + bb_error_msg_and_die("spec file %s is not a regular file", argv[0]); } /* Load the file contexts configuration and check it. */ - rc = matchpathcon_init(argv[optind]); + rc = matchpathcon_init(argv[0]); if (rc < 0) { - bb_perror_msg_and_die("%s", argv[optind]); + bb_simple_perror_msg_and_die(argv[0]); } - - optind++; - if (nerr) - exit(1); + exit(EXIT_FAILURE); + argv++; } - if (use_input_file) { + if (input_filename) { ssize_t len; FILE *f = stdin; if (NOT_LONE_CHAR(input_filename, '-')) - f = xfopen(input_filename, "r"); + f = xfopen_for_read(input_filename); while ((len = getline(&buf, &buf_len, f)) > 0) { buf[len - 1] = '\0'; errors |= process_one(buf); @@ -634,9 +663,9 @@ int setfiles_main(int argc, char **argv) if (ENABLE_FEATURE_CLEAN_UP) fclose_if_not_stdin(f); } else { - if (optind >= argc) + if (!argv[0]) bb_show_usage(); - for (i = optind; i < argc; i++) { + for (i = 0; argv[i]; i++) { errors |= process_one(argv[i]); } }