PERFORCE change 108426 for review

Todd Miller millert at FreeBSD.org
Wed Oct 25 13:49:25 PDT 2006


http://perforce.freebsd.org/chv.cgi?CH=108426

Change 108426 by millert at millert_macbook on 2006/10/25 20:42:34

	Update to libselinux-1.32 from the NSA web site.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/ChangeLog#4 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/Makefile#3 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/VERSION#4 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/include/selinux/av_permissions.h#3 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/include/selinux/avc.h#3 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/src/avc.c#5 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/src/setrans_client.c#2 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/ChangeLog#4 (text+ko) ====

@@ -1,3 +1,18 @@
+1.32 2006-10-17
+	* Updated version for release.
+
+1.30.30 2006-10-05
+	* Merged patch from Darrel Goeddel to always use untranslated
+	  contexts in the userspace AVC.
+
+1.30.29 2006-09-29
+	* Merged av_permissions.h update from Steve Grubb,
+	  adding setsockcreate and polmatch definitions.
+
+1.30.28 2006-09-13
+	* Merged patch from Steve Smalley to fix SIGPIPE in setrans_client
+	* Merged c++ class identifier fix from Joe Nall.
+
 1.30.27 2006-08-24
 	* Merged patch to not log avc stats upon a reset from Steve Grubb.
 	* Applied patch to revert compat_net setting upon policy load.

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/Makefile#3 (text+ko) ====

@@ -21,4 +21,4 @@
 	$(MAKE) -C src $@
 	$(MAKE) -C utils clean
 
-test:+test:

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/VERSION#4 (text+ko) ====

@@ -1,1 +1,1 @@
-1.30.27
+1.32

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/include/selinux/av_permissions.h#3 (text+ko) ====

@@ -468,6 +468,7 @@
 #define PROCESS__EXECSTACK                        0x04000000UL
 #define PROCESS__EXECHEAP                         0x08000000UL
 #define PROCESS__SETKEYCREATE                     0x10000000UL
+#define PROCESS__SETSOCKCREATE                    0x20000000UL
 
 #define IPC__CREATE                               0x00000001UL
 #define IPC__DESTROY                              0x00000002UL
@@ -910,6 +911,7 @@
 #define ASSOCIATION__SENDTO                       0x00000001UL
 #define ASSOCIATION__RECVFROM                     0x00000002UL
 #define ASSOCIATION__SETCONTEXT                   0x00000004UL
+#define ASSOCIATION__POLMATCH                     0x00000008UL
 
 #define NETLINK_KOBJECT_UEVENT_SOCKET__IOCTL      0x00000001UL
 #define NETLINK_KOBJECT_UEVENT_SOCKET__READ       0x00000002UL

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/include/selinux/avc.h#3 (text+ko) ====

@@ -38,6 +38,7 @@
  * available to make the copy, or %EINVAL if the input SID is invalid.
  */
 	int avc_sid_to_context(security_id_t sid, security_context_t * ctx);
+	int avc_sid_to_context_raw(security_id_t sid, security_context_t * ctx);
 
 /**
  * avc_context_to_sid - get SID for context.
@@ -51,6 +52,7 @@
  * returning %0 on success or -%1 on error with @errno set.  
  */
 	int avc_context_to_sid(security_context_t ctx, security_id_t * sid);
+	int avc_context_to_sid_raw(security_context_t ctx, security_id_t * sid);
 
 /**
  * sidget - increment SID reference counter.
@@ -120,7 +122,7 @@
 		void (*func_log) (const char *fmt, ...);
 		/* store a string representation of auditdata (corresponding
 		   to the given security class) into msgbuf. */
-		void (*func_audit) (void *auditdata, security_class_t class,
+		void (*func_audit) (void *auditdata, security_class_t cls,
 				    char *msgbuf, size_t msgbufsize);
 	};
 

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/src/avc.c#5 (text+ko) ====

@@ -205,7 +205,7 @@
 	    & (AVC_CACHE_SLOTS - 1);
 }
 
-int avc_context_to_sid(security_context_t ctx, security_id_t * sid)
+int avc_context_to_sid_raw(security_context_t ctx, security_id_t * sid)
 {
 	int rc;
 	avc_get_lock(avc_lock);
@@ -216,7 +216,22 @@
 	return rc;
 }
 
-int avc_sid_to_context(security_id_t sid, security_context_t * ctx)
+int avc_context_to_sid(security_context_t ctx, security_id_t * sid)
+{
+	int ret;
+	security_context_t rctx;
+
+	if (selinux_trans_to_raw_context(ctx, &rctx))
+		return -1;
+
+	ret = avc_context_to_sid_raw(rctx, sid);
+
+	freecon(rctx);
+
+	return ret;
+}
+
+int avc_sid_to_context_raw(security_id_t sid, security_context_t * ctx)
 {
 	int rc;
 	*ctx = NULL;
@@ -232,6 +247,21 @@
 	return rc;
 }
 
+int avc_sid_to_context(security_id_t sid, security_context_t * ctx)
+{
+	int ret;
+	security_context_t rctx;
+
+	ret = avc_sid_to_context_raw(sid, &rctx);
+
+	if (ret == 0) {
+		ret = selinux_raw_to_trans_context(rctx, ctx);
+		freecon(rctx);
+	}
+
+	return ret;
+}
+
 int sidget(security_id_t sid)
 {
 	int rc;
@@ -943,8 +973,9 @@
 				rc = -1;
 				goto out;
 			}
-			rc = security_compute_av(ssid->ctx, tsid->ctx, tclass,
-						 requested, &entry.avd);
+			rc = security_compute_av_raw(ssid->ctx, tsid->ctx,
+						     tclass, requested,
+						     &entry.avd);
 			if (rc)
 				goto out;
 			rc = avc_insert(ssid, tsid, tclass, &entry, aeref);

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/libselinux/src/setrans_client.c#2 (text+ko) ====

@@ -59,11 +59,12 @@
 static int
 send_request(int fd, uint32_t function, const char *data1, const char *data2)
 {
-	struct iovec req_hdr[3];
+	struct msghdr msgh;
+	struct iovec iov[5];
 	uint32_t data1_size;
 	uint32_t data2_size;
-	struct iovec req_data[2];
-	ssize_t count;
+	ssize_t count, expected;
+	unsigned int i;
 
 	if (fd < 0)
 		return -1;
@@ -76,28 +77,28 @@
 	data1_size = strlen(data1) + 1;
 	data2_size = strlen(data2) + 1;
 
-	req_hdr[0].iov_base = &function;
-	req_hdr[0].iov_len = sizeof(function);
-	req_hdr[1].iov_base = &data1_size;
-	req_hdr[1].iov_len = sizeof(data1_size);
-	req_hdr[2].iov_base = &data2_size;
-	req_hdr[2].iov_len = sizeof(data2_size);
+	iov[0].iov_base = &function;
+	iov[0].iov_len = sizeof(function);
+	iov[1].iov_base = &data1_size;
+	iov[1].iov_len = sizeof(data1_size);
+	iov[2].iov_base = &data2_size;
+	iov[2].iov_len = sizeof(data2_size);
+	iov[3].iov_base = (char *)data1;
+	iov[3].iov_len = data1_size;
+	iov[4].iov_base = (char *)data2;
+	iov[4].iov_len = data2_size;
+	memset(&msgh, 0, sizeof(msgh));
+	msgh.msg_iov = iov;
+	msgh.msg_iovlen = sizeof(iov) / sizeof(iov[0]);
 
-	while (((count = writev(fd, req_hdr, 3)) < 0) && (errno == EINTR)) ;
-	if (count != (sizeof(function) + sizeof(data1_size) +
-		      sizeof(data2_size))) {
-		return -1;
-	}
+	expected = 0;
+	for (i = 0; i < sizeof(iov) / sizeof(iov[0]); i++)
+		expected += iov[i].iov_len;
 
-	req_data[0].iov_base = (char *)data1;
-	req_data[0].iov_len = data1_size;
-	req_data[1].iov_base = (char *)data2;
-	req_data[1].iov_len = data2_size;
-
-	while (((count = writev(fd, req_data, 2)) < 0) && (errno == EINTR)) ;
-	if (count < 0 || (uint32_t) count != (data1_size + data2_size)) {
+	while (((count = sendmsg(fd, &msgh, 0)) < 0)
+	       && (errno == EINTR)) ;
+	if (count < 0 || count != expected)
 		return -1;
-	}
 
 	return 0;
 }


More information about the trustedbsd-cvs mailing list