sestatus: new SELinux applet (KaiGai Kohei <kaigai@ak.jp.nec.com>)

diff --git a/include/applets.h b/include/applets.h
index f188232c41d1187f1beee5d69e876759e1571807..757fa4a25c73a342a42592697da1e5d06c7a2ddf 100644 (file)
--- a/include/applets.h
+++ b/include/applets.h
@@ -300,6 +300,7 @@ USE_RX(APPLET(rx, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SED(APPLET(sed, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SELINUXENABLED(APPLET(selinuxenabled, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SEQ(APPLET_NOFORK(seq, seq, _BB_DIR_USR_BIN, _BB_SUID_NEVER, seq))
+USE_SESTATUS(APPLET(sestatus, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETARCH(APPLET(setarch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SETCONSOLE(APPLET(setconsole, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_SETENFORCE(APPLET(setenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))

diff --git a/include/usage.h b/include/usage.h
index 3c8762ee10b1be19375f0b31fab193dbd8f9e78b..5c03719d6d0c9cd1b4e37483e8be38167f4ba075 100644 (file)
--- a/include/usage.h
+++ b/include/usage.h
@@ -3121,6 +3121,12 @@ USE_FEATURE_RUN_PARTS_FANCY("\n  -l      Prints names of all matching files even when
        "       FIRST LAST\n" \
        "       FIRST INCREMENT LAST"
 
+#define sestatus_trivial_usage \
+       "[-vb]"
+#define sestatus_full_usage \
+       "-v     Verbose\n" \
+       "-b     Display current state of booleans"
+
 #define setconsole_trivial_usage \
        "[-r" USE_FEATURE_SETCONSOLE_LONG_OPTIONS("|--reset") "] [DEVICE]"
 #define setconsole_full_usage \

diff --git a/selinux/Config.in b/selinux/Config.in
index c9b48fb1b4d3ea83345366440c23f81a2f91bf88..f764056a2816325de791f520d7196f6d89f4fbae 100644 (file)
--- a/selinux/Config.in
+++ b/selinux/Config.in
@@ -112,5 +112,12 @@ config SETSEBOOL
          Enable support for change boolean.
          semanage and -P option is not supported yet.
 
+config SESTATUS
+       bool "sestatus"
+       default n
+       depends on SELINUX
+       help
+         Displays the status of SELinux.
+
 endmenu
 

diff --git a/selinux/Kbuild b/selinux/Kbuild
index ce353e06642352dacba34dcead5e19b035152418..d0c190cebd52f64136c1d97cbe4ae5ccf754d8be 100644 (file)
--- a/selinux/Kbuild
+++ b/selinux/Kbuild
@@ -17,3 +17,4 @@ lib-$(CONFIG_SETENFORCE)      += setenforce.o
 lib-$(CONFIG_SETFILES)         += setfiles.o
 lib-$(CONFIG_RESTORECON)       += setfiles.o
 lib-$(CONFIG_SETSEBOOL)                += setsebool.o
+lib-$(CONFIG_SESTATUS)         += sestatus.o

diff --git a/selinux/sestatus.c b/selinux/sestatus.c
new file mode 100644 (file)
index 0000000..cc17b17
--- /dev/null
+++ b/selinux/sestatus.c
@@ -0,0 +1,219 @@
+/*
+ * sestatus -- displays the status of SELinux
+ *
+ * Ported to busybox: KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * Copyright (C) KaiGai Kohei <kaigai@ak.jp.nec.com>
+ */
+
+#include "libbb.h"
+
+extern char *selinux_mnt;
+
+#define OPT_VERBOSE    (1 << 0)
+#define OPT_BOOLEAN    (1 << 1)
+
+#define COL_FMT                "%-31s "
+
+static void display_boolean(void)
+{
+       char **bools;
+       int i, active, pending, nbool;
+
+       if (security_get_boolean_names(&bools, &nbool) < 0)
+               return;
+
+       puts("\nPolicy booleans:");
+
+       for (i = 0; i < nbool; i++) {
+               active = security_get_boolean_active(bools[i]);
+               if (active < 0)
+                       goto skip;
+               pending = security_get_boolean_pending(bools[i]);
+               if (pending < 0)
+                       goto skip;
+               printf(COL_FMT "%s",
+                      bools[i], active == 0 ? "off" : "on");
+               if (active != pending)
+                       printf(" (%sactivate pending)", pending == 0 ? "in" : "");
+               bb_putchar('\n');
+ skip:
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       free(bools[i]);
+       }
+       if (ENABLE_FEATURE_CLEAN_UP)
+               free(bools);
+}
+
+static void read_config(char **pc, int npc, char **fc, int nfc)
+{
+       char buf[256];
+       FILE *fp;
+       int pc_ofs = 0, fc_ofs = 0, section = -1;
+
+       pc[0] = fc[0] = NULL;
+
+       fp = fopen("/etc/sestatus.conf", "rb");
+       if (fp == NULL)
+               return;
+
+       while (fgets(buf, sizeof(buf), fp) != NULL) {
+               int i, c;
+
+               /* kills comments */
+               for (i = 0; (c = buf[i]) != '\0'; i++) {
+                       if (c == '#') {
+                               buf[i] = '\0';
+                               break;
+                       }
+               }
+               trim(buf);
+
+               if (buf[0] == '\0')
+                       continue;
+
+               if (strcmp(buf, "[process]") == 0) {
+                       section = 1;
+               } else if (strcmp(buf, "[files]") == 0) {
+                       section = 2;
+               } else {
+                       if (section == 1 && pc_ofs < npc -1) {
+                               pc[pc_ofs++] = strdup(buf);
+                               pc[pc_ofs] = NULL;
+                       } else if (section == 2 && fc_ofs < nfc - 1) {
+                               fc[fc_ofs++] = strdup(buf);
+                               fc[fc_ofs] = NULL;
+                       }
+               }
+       }
+       fclose(fp);
+}
+
+static void display_verbose(void)
+{
+       security_context_t con, _con;
+       char *fc[50], *pc[50], *cterm;
+       pid_t *pidList;
+       int i;
+
+       read_config(pc, ARRAY_SIZE(pc), fc, ARRAY_SIZE(fc));
+
+       /* process contexts */
+       puts("\nProcess contexts:");
+
+       /* current context */
+       if (getcon(&con) == 0) {
+               printf(COL_FMT "%s\n", "Current context:", con);
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       freecon(con);
+       }
+       /* /sbin/init context */
+       if (getpidcon(1, &con) == 0) {
+               printf(COL_FMT "%s\n", "Init context:", con);
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       freecon(con);
+       }
+
+       /* [process] context */
+       for (i = 0; pc[i] != NULL; i++) {
+               pidList = find_pid_by_name(bb_basename(pc[i]));
+               if (pidList[0] > 0 && getpidcon(pidList[0], &con) == 0) {
+                       printf(COL_FMT "%s\n", pc[i], con);
+                       if (ENABLE_FEATURE_CLEAN_UP)
+                               freecon(con);
+               }
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       free(pidList);
+       }
+
+       /* files contexts */
+       puts("\nFile contexts:");
+
+       cterm = ttyname(0);
+       puts(cterm);
+       if (cterm && lgetfilecon(cterm, &con) >= 0) {
+               printf(COL_FMT "%s\n", "Controlling term:", con);
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       freecon(con);
+       }
+
+       for (i=0; fc[i] != NULL; i++) {
+               struct stat stbuf;
+
+               if (lgetfilecon(fc[i], &con) < 0)
+                       continue;
+               if (lstat(fc[i], &stbuf) == 0) {
+                       if (S_ISLNK(stbuf.st_mode)) {
+                               if (getfilecon(fc[i], &_con) >= 0) {
+                                       printf(COL_FMT "%s -> %s\n", fc[i], _con, con);
+                                       if (ENABLE_FEATURE_CLEAN_UP)
+                                               freecon(_con);
+                               }
+                       } else {
+                               printf(COL_FMT "%s\n", fc[i], con);
+                       }
+               }
+               if (ENABLE_FEATURE_CLEAN_UP)
+                       freecon(con);
+       }
+}
+
+int sestatus_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int sestatus_main(int argc, char **argv)
+{
+       unsigned opts;
+       const char *pol_path;
+       int rc;
+
+       opt_complementary = "?0";       /* no arguments are required. */
+       opts = getopt32(argv, "vb");
+
+       /* SELinux status: line */
+       rc = is_selinux_enabled();
+       if (rc < 0)
+               goto error;
+       printf(COL_FMT "%s\n", "SELinux status:",
+              rc == 1 ? "enabled" : "disabled");
+
+       /* SELinuxfs mount: line */
+       if (!selinux_mnt)
+               goto error;
+       printf(COL_FMT "%s\n", "SELinuxfs mount:",
+              selinux_mnt);
+
+       /* Current mode: line */
+       rc = security_getenforce();
+       if (rc < 0)
+               goto error;
+       printf(COL_FMT "%s\n", "Current mode:",
+              rc == 0 ? "permissive" : "enforcing");
+
+       /* Mode from config file: line */
+       if (selinux_getenforcemode(&rc) != 0)
+               goto error;
+       printf(COL_FMT "%s\n", "Mode from config file:",
+              rc < 0 ? "disabled" : (rc == 0 ? "permissive" : "enforcing"));
+
+       /* Policy version: line */
+       rc = security_policyvers();
+       if (rc < 0)
+               goto error;
+       printf(COL_FMT "%u\n", "Policy version:", rc);
+
+       /* Policy from config file: line */
+       pol_path = selinux_policy_root();
+       if (!pol_path)
+               goto error;
+       printf(COL_FMT "%s\n", "Policy from config file:",
+              bb_basename(pol_path));
+
+       if (opts & OPT_BOOLEAN)
+               display_boolean();
+       if (opts & OPT_VERBOSE)
+               display_verbose();
+
+       return 0;
+
+  error:
+       bb_perror_msg_and_die("libselinux returns unknown state");
+}