You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
201 lines
6.8 KiB
201 lines
6.8 KiB
From 76371721bafed56efcb7a83b3fa3285383ede5b7 Mon Sep 17 00:00:00 2001
|
|
From: Baichuan Kong <kongbaichuan@huawei.com>
|
|
Date: Thu, 14 Nov 2019 10:48:07 +0800
|
|
Subject: [PATCH] restorecond: Fix redundant console log output error
|
|
|
|
When starting restorecond without any option the following redundant
|
|
console log is outputed:
|
|
|
|
/dev/log 100.0%
|
|
/var/volatile/run/syslogd.pid 100.0%
|
|
...
|
|
|
|
This is caused by two global variables of same name r_opts. When
|
|
executes r_opts = opts in restore_init(), it originally intends
|
|
to assign the address of struct r_opts in "restorecond.c" to the
|
|
pointer *r_opts in "restore.c".
|
|
|
|
However, the address is assigned to the struct r_opts and covers
|
|
the value of low eight bytes in it. That causes unexpected value
|
|
of member varibale 'nochange' and 'verbose' in struct r_opts, thus
|
|
affects value of 'restorecon_flags' and executes unexpected operations
|
|
when restorecon the files such as the redundant console log output or
|
|
file label nochange.
|
|
|
|
Cause restorecond/restore.c is copied from policycoreutils/setfiles,
|
|
which share the same pattern. It also has potential risk to generate
|
|
same problems, So fix it in case.
|
|
|
|
Signed-off-by: Baichuan Kong <kongbaichuan@huawei.com>
|
|
|
|
(cherry-picked from SElinuxProject
|
|
commit ad2208ec220f55877a4d31084be2b4d6413ee082)
|
|
|
|
Resolves: rhbz#1626468
|
|
---
|
|
policycoreutils/setfiles/restore.c | 42 ++++++++++++++----------------
|
|
restorecond/restore.c | 40 +++++++++++++---------------
|
|
2 files changed, 37 insertions(+), 45 deletions(-)
|
|
|
|
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
|
|
index 9dea5656..d3335d1a 100644
|
|
--- a/policycoreutils/setfiles/restore.c
|
|
+++ b/policycoreutils/setfiles/restore.c
|
|
@@ -17,40 +17,37 @@
|
|
char **exclude_list;
|
|
int exclude_count;
|
|
|
|
-struct restore_opts *r_opts;
|
|
-
|
|
void restore_init(struct restore_opts *opts)
|
|
{
|
|
int rc;
|
|
|
|
- r_opts = opts;
|
|
struct selinux_opt selinux_opts[] = {
|
|
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
|
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
|
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
|
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
|
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
|
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
|
};
|
|
|
|
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
|
- if (!r_opts->hnd) {
|
|
- perror(r_opts->selabel_opt_path);
|
|
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
|
+ if (!opts->hnd) {
|
|
+ perror(opts->selabel_opt_path);
|
|
exit(1);
|
|
}
|
|
|
|
- r_opts->restorecon_flags = 0;
|
|
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
|
- r_opts->progress | r_opts->set_specctx |
|
|
- r_opts->add_assoc | r_opts->ignore_digest |
|
|
- r_opts->recurse | r_opts->userealpath |
|
|
- r_opts->xdev | r_opts->abort_on_error |
|
|
- r_opts->syslog_changes | r_opts->log_matches |
|
|
- r_opts->ignore_noent | r_opts->ignore_mounts |
|
|
- r_opts->mass_relabel;
|
|
+ opts->restorecon_flags = 0;
|
|
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
|
+ opts->progress | opts->set_specctx |
|
|
+ opts->add_assoc | opts->ignore_digest |
|
|
+ opts->recurse | opts->userealpath |
|
|
+ opts->xdev | opts->abort_on_error |
|
|
+ opts->syslog_changes | opts->log_matches |
|
|
+ opts->ignore_noent | opts->ignore_mounts |
|
|
+ opts->mass_relabel;
|
|
|
|
/* Use setfiles, restorecon and restorecond own handles */
|
|
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
|
+ selinux_restorecon_set_sehandle(opts->hnd);
|
|
|
|
- if (r_opts->rootpath) {
|
|
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
|
+ if (opts->rootpath) {
|
|
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
|
if (rc) {
|
|
fprintf(stderr,
|
|
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
|
@@ -81,7 +78,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
|
size_t i = 0;
|
|
int len, rc, errors;
|
|
|
|
- r_opts = opts;
|
|
memset(&globbuf, 0, sizeof(globbuf));
|
|
|
|
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
|
@@ -96,7 +92,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
|
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
|
continue;
|
|
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
|
- r_opts->restorecon_flags);
|
|
+ opts->restorecon_flags);
|
|
if (rc < 0)
|
|
errors = rc;
|
|
}
|
|
diff --git a/restorecond/restore.c b/restorecond/restore.c
|
|
index f6e30001..b93b5fdb 100644
|
|
--- a/restorecond/restore.c
|
|
+++ b/restorecond/restore.c
|
|
@@ -12,39 +12,36 @@
|
|
char **exclude_list;
|
|
int exclude_count;
|
|
|
|
-struct restore_opts *r_opts;
|
|
-
|
|
void restore_init(struct restore_opts *opts)
|
|
{
|
|
int rc;
|
|
|
|
- r_opts = opts;
|
|
struct selinux_opt selinux_opts[] = {
|
|
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
|
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
|
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
|
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
|
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
|
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
|
};
|
|
|
|
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
|
- if (!r_opts->hnd) {
|
|
- perror(r_opts->selabel_opt_path);
|
|
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
|
+ if (!opts->hnd) {
|
|
+ perror(opts->selabel_opt_path);
|
|
exit(1);
|
|
}
|
|
|
|
- r_opts->restorecon_flags = 0;
|
|
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
|
- r_opts->progress | r_opts->set_specctx |
|
|
- r_opts->add_assoc | r_opts->ignore_digest |
|
|
- r_opts->recurse | r_opts->userealpath |
|
|
- r_opts->xdev | r_opts->abort_on_error |
|
|
- r_opts->syslog_changes | r_opts->log_matches |
|
|
- r_opts->ignore_noent | r_opts->ignore_mounts;
|
|
+ opts->restorecon_flags = 0;
|
|
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
|
+ opts->progress | opts->set_specctx |
|
|
+ opts->add_assoc | opts->ignore_digest |
|
|
+ opts->recurse | opts->userealpath |
|
|
+ opts->xdev | opts->abort_on_error |
|
|
+ opts->syslog_changes | opts->log_matches |
|
|
+ opts->ignore_noent | opts->ignore_mounts;
|
|
|
|
/* Use setfiles, restorecon and restorecond own handles */
|
|
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
|
+ selinux_restorecon_set_sehandle(opts->hnd);
|
|
|
|
- if (r_opts->rootpath) {
|
|
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
|
+ if (opts->rootpath) {
|
|
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
|
if (rc) {
|
|
fprintf(stderr,
|
|
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
|
@@ -75,7 +72,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
|
size_t i = 0;
|
|
int len, rc, errors;
|
|
|
|
- r_opts = opts;
|
|
memset(&globbuf, 0, sizeof(globbuf));
|
|
|
|
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
|
@@ -90,7 +86,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
|
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
|
continue;
|
|
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
|
- r_opts->restorecon_flags);
|
|
+ opts->restorecon_flags);
|
|
if (rc < 0)
|
|
errors = rc;
|
|
}
|
|
--
|
|
2.21.0
|
|
|