summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--packaging/device-sec-policy1
-rw-r--r--packaging/rpm.changes6
-rw-r--r--packaging/security_4.9.1.patch254
3 files changed, 124 insertions, 137 deletions
diff --git a/packaging/device-sec-policy b/packaging/device-sec-policy
index f11dbf1..83c0c46 100644
--- a/packaging/device-sec-policy
+++ b/packaging/device-sec-policy
@@ -33,6 +33,7 @@ tRrR5cbqmVr8tkFjS/QK6TWfNMM=
<package name="ac-domain-system">
<provide>
<ac_domain name="_" policy="shared"/>
+ <ac_domain name="Isolated"/>
</provide>
</package>
<package name="root"/>
diff --git a/packaging/rpm.changes b/packaging/rpm.changes
index 7b8f142..73d848d 100644
--- a/packaging/rpm.changes
+++ b/packaging/rpm.changes
@@ -1,3 +1,9 @@
+* Wed Aug 08 2012 Elena Reshetova <elena.reshetova@intel.com> - 4.9.0
+- Changes to the security plugin
+ - Moving the setup of xattr to the FSM_CLOSED hook
+ - Adding a new ac domain "Isolated" to the policy
+ - Using "Isolated" domain in cases when default labels of the files can't be determined
+
* Mon Aug 06 2012 William Douglas <william.douglas@intel.com> build/2012-07-30.142546@9c7636b
[ William Douglas ]
- Keep function symbols for backtraces.
diff --git a/packaging/security_4.9.1.patch b/packaging/security_4.9.1.patch
index 9a67be4..2f046f2 100644
--- a/packaging/security_4.9.1.patch
+++ b/packaging/security_4.9.1.patch
@@ -1,10 +1,6 @@
-From: Elena Reshetova <elena.reshetova@intel.com>
-Date: Tue, 24 Jul 2012 12:46:12 -0700
-Subject: [PATCH] Adding security hooks and security plugin
-
diff -Nuarp rpm/build/files.c rpm-security/build/files.c
--- rpm/build/files.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/build/files.c 2012-07-24 12:27:43.007952103 +0300
++++ rpm-security/build/files.c 2012-08-06 12:49:34.333011443 +0300
@@ -827,6 +827,7 @@ static VFA_t virtualFileAttributes[] = {
{ "%readme", 0, RPMFILE_README },
{ "%license", 0, RPMFILE_LICENSE },
@@ -48,7 +44,7 @@ diff -Nuarp rpm/build/files.c rpm-security/build/files.c
}
diff -Nuarp rpm/build/parsePreamble.c rpm-security/build/parsePreamble.c
--- rpm/build/parsePreamble.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/build/parsePreamble.c 2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/build/parsePreamble.c 2012-08-06 12:49:34.333011443 +0300
@@ -216,7 +216,7 @@ static int addSource(rpmSpec spec, Packa
*fieldp = '\0';
@@ -68,7 +64,7 @@ diff -Nuarp rpm/build/parsePreamble.c rpm-security/build/parsePreamble.c
diff -Nuarp rpm/configure.ac rpm-security/configure.ac
--- rpm/configure.ac 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/configure.ac 2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/configure.ac 2012-08-06 12:49:34.337011459 +0300
@@ -653,6 +653,65 @@ AC_SUBST(WITH_SELINUX_LIB)
AC_SUBST(WITH_SEMANAGE_LIB)
AM_CONDITIONAL(SELINUX,[test "$with_selinux" = yes])
@@ -156,7 +152,7 @@ diff -Nuarp rpm/configure.ac rpm-security/configure.ac
AC_OUTPUT
diff -Nuarp rpm/lib/fsm.c rpm-security/lib/fsm.c
--- rpm/lib/fsm.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/fsm.c 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/fsm.c 2012-08-06 12:49:34.337011459 +0300
@@ -28,6 +28,8 @@
#include "lib/rpmts_internal.h" /* rpmtsSELabelFoo() only */
#include "lib/rpmug.h"
@@ -212,7 +208,7 @@ diff -Nuarp rpm/lib/fsm.c rpm-security/lib/fsm.c
}
diff -Nuarp rpm/lib/Makefile.am rpm-security/lib/Makefile.am
--- rpm/lib/Makefile.am 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/Makefile.am 2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/lib/Makefile.am 2012-08-06 12:49:34.337011459 +0300
@@ -36,7 +36,8 @@ librpm_la_SOURCES = \
verify.c rpmlock.c rpmlock.h misc.h \
rpmscript.h rpmscript.c legacy.c merge.c \
@@ -225,7 +221,7 @@ diff -Nuarp rpm/lib/Makefile.am rpm-security/lib/Makefile.am
diff -Nuarp rpm/lib/package.c rpm-security/lib/package.c
--- rpm/lib/package.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/package.c 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/package.c 2012-08-06 12:49:34.341011475 +0300
@@ -18,6 +18,8 @@
#include "rpmio/rpmio_internal.h" /* fd digest bits */
#include "lib/header_internal.h" /* XXX headerCheck */
@@ -249,7 +245,7 @@ diff -Nuarp rpm/lib/package.c rpm-security/lib/package.c
rpmlog(RPMLOG_DEBUG, "%s: %s", fn, msg);
diff -Nuarp rpm/lib/rpmfi.h rpm-security/lib/rpmfi.h
--- rpm/lib/rpmfi.h 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmfi.h 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmfi.h 2012-08-06 12:49:34.341011475 +0300
@@ -60,6 +60,7 @@ enum rpmfileAttrs_e {
RPMFILE_EXCLUDE = (1 << 9), /*!< from %%exclude, internal */
RPMFILE_UNPATCHED = (1 << 10), /*!< placeholder (SuSE) */
@@ -260,7 +256,7 @@ diff -Nuarp rpm/lib/rpmfi.h rpm-security/lib/rpmfi.h
typedef rpmFlags rpmfileAttrs;
diff -Nuarp rpm/lib/rpmscript.c rpm-security/lib/rpmscript.c
--- rpm/lib/rpmscript.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmscript.c 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmscript.c 2012-08-06 12:49:34.341011475 +0300
@@ -14,6 +14,8 @@
#include "rpmio/rpmlua.h"
#include "lib/rpmscript.h"
@@ -291,7 +287,7 @@ diff -Nuarp rpm/lib/rpmscript.c rpm-security/lib/rpmscript.c
}
diff -Nuarp rpm/lib/rpmsecurity.c rpm-security/lib/rpmsecurity.c
--- rpm/lib/rpmsecurity.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/lib/rpmsecurity.c 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmsecurity.c 2012-08-06 12:49:34.345011498 +0300
@@ -0,0 +1,269 @@
+#include "system.h"
+
@@ -564,7 +560,7 @@ diff -Nuarp rpm/lib/rpmsecurity.c rpm-security/lib/rpmsecurity.c
+}
diff -Nuarp rpm/lib/rpmsecurity.h rpm-security/lib/rpmsecurity.h
--- rpm/lib/rpmsecurity.h 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/lib/rpmsecurity.h 2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmsecurity.h 2012-08-06 12:49:34.345011498 +0300
@@ -0,0 +1,161 @@
+#ifndef _SECURITY_H
+#define _SECURITY_H
@@ -729,7 +725,7 @@ diff -Nuarp rpm/lib/rpmsecurity.h rpm-security/lib/rpmsecurity.h
+#endif /* _SECURITY_H */
diff -Nuarp rpm/lib/rpmtag.h rpm-security/lib/rpmtag.h
--- rpm/lib/rpmtag.h 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmtag.h 2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmtag.h 2012-08-06 12:49:34.345011498 +0300
@@ -299,7 +299,8 @@ typedef enum rpmTag_e {
RPMTAG_ORDERNAME = 5035, /* s[] */
RPMTAG_ORDERVERSION = 5036, /* s[] */
@@ -742,7 +738,7 @@ diff -Nuarp rpm/lib/rpmtag.h rpm-security/lib/rpmtag.h
diff -Nuarp rpm/lib/rpmte.c rpm-security/lib/rpmte.c
--- rpm/lib/rpmte.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmte.c 2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmte.c 2012-08-06 12:49:34.345011498 +0300
@@ -14,7 +14,9 @@
#include <rpm/rpmlog.h>
@@ -783,7 +779,7 @@ diff -Nuarp rpm/lib/rpmte.c rpm-security/lib/rpmte.c
diff -Nuarp rpm/lib/rpmts.c rpm-security/lib/rpmts.c
--- rpm/lib/rpmts.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmts.c 2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmts.c 2012-08-06 12:49:34.345011498 +0300
@@ -24,6 +24,7 @@
#include "lib/rpmal.h"
#include "lib/rpmchroot.h"
@@ -803,7 +799,7 @@ diff -Nuarp rpm/lib/rpmts.c rpm-security/lib/rpmts.c
rpmtsPrintStats(ts);
diff -Nuarp rpm/lib/rpmtypes.h rpm-security/lib/rpmtypes.h
--- rpm/lib/rpmtypes.h 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmtypes.h 2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmtypes.h 2012-08-06 12:49:34.349011527 +0300
@@ -78,6 +78,7 @@ typedef struct rpmPubkey_s * rpmPubkey;
typedef struct rpmKeyring_s * rpmKeyring;
@@ -814,7 +810,7 @@ diff -Nuarp rpm/lib/rpmtypes.h rpm-security/lib/rpmtypes.h
diff -Nuarp rpm/lib/transaction.c rpm-security/lib/transaction.c
--- rpm/lib/transaction.c 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/transaction.c 2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/transaction.c 2012-08-06 12:49:34.349011527 +0300
@@ -21,6 +21,8 @@
#include "lib/rpmts_internal.h"
#include "rpmio/rpmhook.h"
@@ -866,7 +862,7 @@ diff -Nuarp rpm/lib/transaction.c rpm-security/lib/transaction.c
rpmlog(RPMLOG_DEBUG, "running post-transaction scripts\n");
diff -Nuarp rpm/macros.in rpm-security/macros.in
--- rpm/macros.in 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/macros.in 2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/macros.in 2012-08-06 12:49:34.349011527 +0300
@@ -1070,5 +1070,7 @@ done \
%__collection_sepolicy %{__plugindir}/sepolicy.so
%__collection_sepolicy_flags 1
@@ -877,7 +873,7 @@ diff -Nuarp rpm/macros.in rpm-security/macros.in
#*/
diff -Nuarp rpm/Makefile.am rpm-security/Makefile.am
--- rpm/Makefile.am 2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/Makefile.am 2012-07-24 12:27:43.003952083 +0300
++++ rpm-security/Makefile.am 2012-08-06 12:49:34.349011527 +0300
@@ -29,7 +29,11 @@ if ENABLE_PLUGINS
SUBDIRS += plugins
endif
@@ -902,7 +898,7 @@ diff -Nuarp rpm/Makefile.am rpm-security/Makefile.am
diff -Nuarp rpm/preinstall.am rpm-security/preinstall.am
--- rpm/preinstall.am 2012-07-11 11:00:51.000000000 +0300
-+++ rpm-security/preinstall.am 2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/preinstall.am 2012-08-06 12:49:34.349011527 +0300
@@ -114,6 +114,14 @@ include/rpm/rpmvf.h: lib/rpmvf.h include
$(INSTALL_DATA) $(top_srcdir)/lib/rpmvf.h include/rpm/rpmvf.h
BUILT_SOURCES += include/rpm/rpmvf.h
@@ -920,7 +916,7 @@ diff -Nuarp rpm/preinstall.am rpm-security/preinstall.am
BUILT_SOURCES += include/rpm/rpmsign.h
diff -Nuarp rpm/security/Makefile.am rpm-security/security/Makefile.am
--- rpm/security/Makefile.am 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/Makefile.am 2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/Makefile.am 2012-08-06 12:49:34.369011618 +0300
@@ -0,0 +1,24 @@
+# Makefile for rpm library.
+
@@ -948,7 +944,7 @@ diff -Nuarp rpm/security/Makefile.am rpm-security/security/Makefile.am
+endif
diff -Nuarp rpm/security/Makefile.msm rpm-security/security/Makefile.msm
--- rpm/security/Makefile.msm 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/Makefile.msm 2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/Makefile.msm 2012-08-06 12:49:34.369011618 +0300
@@ -0,0 +1,15 @@
+CC=gcc
+CFLAGS=-g -Wall
@@ -967,8 +963,8 @@ diff -Nuarp rpm/security/Makefile.msm rpm-security/security/Makefile.msm
+ rm msmmatch *.o
diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
--- rpm/security/msm.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msm.c 2012-07-24 12:42:23.144316466 +0300
-@@ -0,0 +1,914 @@
++++ rpm-security/security/msm.c 2012-08-06 13:32:38.137823835 +0300
+@@ -0,0 +1,909 @@
+/*
+ * This file is part of MSM security plugin
+ * Greatly based on the code of MSSF security plugin
@@ -1611,7 +1607,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ packagecontext *ctx = context;
+ if (!ctx) return RPMRC_FAIL;
+
-+ rpmlog(RPMLOG_DEBUG, "Started with FSM_OPENED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
++
+
+ ctx->path = getFilePath(fsm->dirName, fsm->baseName);
+ rpmlog(RPMLOG_DEBUG, "Constructed file name: %s \n", ctx->path);
@@ -1638,7 +1634,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ HASH_Begin(ctx->hashctx);
+ }
+
-+ rpmlog(RPMLOG_DEBUG, "Finished with FSM_OPENED_FUNC hook for file: %s \n", ctx->path);
++
+
+ return RPMRC_OK;
+}
@@ -1649,7 +1645,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ packagecontext *ctx = context;
+ if (!ctx) return RPMRC_FAIL;
+
-+ rpmlog(RPMLOG_DEBUG, "Started with FSM_UPDATED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
++
+
+ if (ctx->hashctx) {
+ const unsigned char *ptr = (unsigned char *)fsm->wrbuf;
@@ -1673,7 +1669,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ }
+ }
+
-+ rpmlog(RPMLOG_DEBUG, "Finished with FSM_UPDATED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
++
+ return RPMRC_OK;
+}
+
@@ -1681,7 +1677,6 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+{
+
+ unsigned char digest[SHA1_LENGTH] = { 0 };
-+ rpmRC rc = RPMRC_FAIL;
+ packagecontext *ctx = context;
+ if (!ctx) return RPMRC_FAIL;
+
@@ -1708,13 +1703,23 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ ctx->path = NULL;
+ ctx->ino = 0;
+ }
-+ }
-+ rc = RPMRC_OK;
++
++ if (rpmteType(ctx->te) == TR_ADDED) {
++ if (msmSetFileXAttributes(ctx->mfx, file->path) < 0) {
++ rpmlog(RPMLOG_ERR, "Setting of extended attributes failed for file %s from package %s\n",
++ file->path, rpmteN(ctx->te));
++ return RPMRC_FAIL;
++ }
++ }
++ } else {
++ rpmlog(RPMLOG_ERR, "Manifest is missing while it should be present for the package %s\n",
++ rpmteN(ctx->te));
++ return RPMRC_FAIL;
++ }
+ }
+
+ rpmlog(RPMLOG_DEBUG, "Finished with FSM_CLOSED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
-+ return rc;
-+
++ return RPMRC_OK;
+}
+
+rpmRC SECURITYHOOK_POST_PSM_FUNC(rpmte te, char* rootDir, int rpmrc)
@@ -1742,22 +1747,8 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+ root = context->mfx;
+ }
+
-+ if (rpmteType(ctx->te) == TR_ADDED) {
-+ if (rootSWSource || ctx->mfx->sw_source) {
-+ if (ctx->mfx->files) {
-+ ret = msmSetFilesystemLabels(ctx->mfx, rootDir);
-+ if (ret) {
-+ rpmlog(RPMLOG_ERR, "Filesystem label setup failed for %s\n",
-+ rpmteN(ctx->te));
-+ msmCancelPackage(ctx->mfx->name);
-+ goto exit;
-+ }
-+ }
-+
-+ } /* else unsigned package */
-+
-+ } else { /* TR_REMOVED */
+
++ if (rpmteType(ctx->te) == TR_REMOVED) {
+ if (ctx->mfx->sw_source) {
+ if (rpmteDependsOn(ctx->te)) {
+ rpmlog(RPMLOG_INFO, "upgrading %s manifest data\n",
@@ -1885,7 +1876,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
+}
diff -Nuarp rpm/security/msmconfig.c rpm-security/security/msmconfig.c
--- rpm/security/msmconfig.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmconfig.c 2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/msmconfig.c 2012-08-06 12:49:34.377011655 +0300
@@ -0,0 +1,264 @@
+/*
+ * This file is part of MSM security plugin
@@ -2153,8 +2144,8 @@ diff -Nuarp rpm/security/msmconfig.c rpm-security/security/msmconfig.c
+
diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
--- rpm/security/msm.h 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msm.h 2012-07-24 12:31:43.385144067 +0300
-@@ -0,0 +1,466 @@
++++ rpm-security/security/msm.h 2012-08-06 12:49:34.377011655 +0300
+@@ -0,0 +1,467 @@
+/*
+ * This file is part of MSM security plugin
+ * Greatly based on the code of MSSF security plugin
@@ -2198,6 +2189,8 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
+#define DEVICE_SECURITY_POLICY "/etc/device-sec-policy"
+#define SMACK_LOAD_PATH "/smack/load"
+
++#define SMACK_ISOLATED_LABEL "Isolated"
++
+#define SMACK_LABEL_LENGTH 255
+#define SMACK_ACCESS_TYPE_LENGHT 5
+#define SMACK_UNINSTALL 1
@@ -2542,14 +2535,13 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
+ */
+package_x *msmFreePackage(package_x *package);
+
-+
+/** \ingroup msm
-+ * Set Smack object labels based on manifest filesystem tags.
-+ * @param mfx package manifest
-+ * @param rootDir root directory of installation
++ * Set extended attributes of the file based on manifest.
++ * @param mfx package manifest
++ * @param filepath path of the file
+ * @return 0 on success, else -1
+ */
-+int msmSetFilesystemLabels(manifest_x *mfx, char* rootDir);
++int msmSetFileXAttributes(manifest_x *mfx, const char* filepath);
+
+/** \ingroup msm
+ * Set setup the request section of manifest.
@@ -2623,7 +2615,7 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
+#endif
diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
--- rpm/security/msmmanifest.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmmanifest.c 2012-07-24 12:27:43.027952214 +0300
++++ rpm-security/security/msmmanifest.c 2012-08-06 12:49:34.381011684 +0300
@@ -0,0 +1,1457 @@
+/*
+ * This file is part of MSM security plugin
@@ -2702,7 +2694,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
+ return ret;
+}
+
-+ac_domain_x *msmFreeACDomain(ac_domain_x *ac_domain)
++static ac_domain_x *msmFreeACDomain(ac_domain_x *ac_domain)
+{
+ if (ac_domain) {
+ ac_domain_x *prev = ac_domain->prev;
@@ -4084,7 +4076,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
+}
diff -Nuarp rpm/security/msmmatch.c rpm-security/security/msmmatch.c
--- rpm/security/msmmatch.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmmatch.c 2012-07-24 12:27:43.027952214 +0300
++++ rpm-security/security/msmmatch.c 2012-08-06 12:49:34.381011684 +0300
@@ -0,0 +1,71 @@
+/*
+ * This file is part of MSM security plugin
@@ -4159,8 +4151,8 @@ diff -Nuarp rpm/security/msmmatch.c rpm-security/security/msmmatch.c
+
diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
--- rpm/security/msmxattr.c 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmxattr.c 2012-07-24 12:44:01.576804569 +0300
-@@ -0,0 +1,1340 @@
++++ rpm-security/security/msmxattr.c 2012-08-06 13:37:44.891344948 +0300
+@@ -0,0 +1,1328 @@
+/*
+ * This file is part of MSM security plugin
+ * Greatly based on the code of MSSF security plugin
@@ -5283,26 +5275,26 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
+ pclose(pipe);
+ return result;
+}
-+int msmSetFilesystemLabels(manifest_x *mfx, char* rootDir) {
-+ file_x *file;
-+ provide_x *provide;
-+ filesystem_x *filesystem;
-+ int fd, ret = 0;
-+ size_t len;
++
++int msmSetFileXAttributes(manifest_x *mfx, const char* filepath) {
++
++ provide_x *provide = NULL;
++ filesystem_x *filesystem = NULL;
++ int fd;
++ size_t len = 0, match = 0;
+ const char *label = NULL;
+ const char *exec_label = NULL;
+ const char *type = NULL;
-+ int match = 0;
++ const char isolatedLabel[] = SMACK_ISOLATED_LABEL;
+ struct stat st;
+
-+ for (file = mfx->files; file; file = file->prev) {
-+ if (mfx->name) {
-+ package_x *package = msmCheckPackage(mfx->name);
-+ if (!package)
-+ return -1;
-+ for (provide = package->provides; provide; provide = provide->prev) {
-+ for (filesystem = provide->filesystems; filesystem; filesystem = filesystem->prev) {
-+ if (!strcmp(file->path, filesystem->path)) {
++ if (mfx->name) {
++ package_x *package = msmCheckPackage(mfx->name);
++ if (!package)
++ return -1;
++ for (provide = package->provides; provide; provide = provide->prev) {
++ for (filesystem = provide->filesystems; filesystem; filesystem = filesystem->prev) {
++ if (!strcmp(filepath, filesystem->path)) {
+ /* exact match */
+ label = filesystem->label;
+ exec_label = filesystem->exec_label;
@@ -5311,18 +5303,18 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
+ }
+ len = strlen(filesystem->path);
+ if (len > match) {
-+ if ((!strncmp(file->path, filesystem->path, len)) && (filesystem->type)) {
++ if ((!strncmp(filepath, filesystem->path, len)) && (filesystem->type)) {
+ /* partial match and the directory marked as transmutable*/
+ label = filesystem->label;
-+ exec_label = filesystem->exec_label;
++ exec_label = filesystem->exec_label;
+ match = len;
+ }
+ }
-+ }
+ }
-+ match = 0;
-+ } else
-+ return -1;
++ }
++ } else
++ return -1;
++
+ found:
+ if ((!label) || (!exec_label)) {
+ /* no match, use default label of AC domain */
@@ -5331,99 +5323,87 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
+ if (!label) label = mfx->request->ac_domain;
+ if (!exec_label) exec_label = mfx->request->ac_domain;
+ } else {
-+ rpmlog(RPMLOG_ERR, "Request for AC domain is empty. Can't identify default file label\n");
-+ return -1;
++ rpmlog(RPMLOG_INFO, "Request for AC domain is empty. Can't identify default file label\n");
++ rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++ if (!label) label = isolatedLabel;
++ if (!exec_label) exec_label = isolatedLabel;
+ }
+ } else if (mfx->define) { // AC domain defined in manifest
+ if (mfx->define->name) {
+ if (!label) label = mfx->define->name;
+ if (!exec_label) exec_label = mfx->define->name;
+ } else {
-+ rpmlog(RPMLOG_ERR, "Define for AC domain is empty. Can't identify default file label\n");
-+ return -1;
++ rpmlog(RPMLOG_INFO, "Define for AC domain is empty. Can't identify default file label\n");
++ rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++ if (!label) label = isolatedLabel;
++ if (!exec_label) exec_label = isolatedLabel;
+ }
-+ } else { // no request or definition of domain, return an error
-+ rpmlog(RPMLOG_ERR, "Both request and define for AC domain are empty. Can't identify default file label\n");
-+ return -1;
++ } else { // no request or definition of domain
++ rpmlog(RPMLOG_INFO, "Both define and request sections are empty. Can't identify default file label\n");
++ rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++ if (!label) label = isolatedLabel;
++ if (!exec_label) exec_label = isolatedLabel;
+ }
+ }
+
-+ char* fullPath = NULL;
-+ if ((rootDir) && (strcmp(rootDir, "/") != 0)) {
-+ fullPath = calloc(strlen(rootDir) + strlen(file->path), sizeof(char));
-+ snprintf(fullPath, strlen(rootDir) + strlen(file->path), "%s%s", rootDir, file->path + 1);
-+ rpmlog(RPMLOG_DEBUG, "Full path %s, file->path: %s, rootDir: %s\n", fullPath, file->path, rootDir);
-+ } else
-+ fullPath = file->path;
-+
-+ fd = open(fullPath, O_RDONLY);
++ fd = open(filepath, O_RDONLY);
+ if (fd == -1) {
+ rpmlog(RPMLOG_ERR, "Failed to open %s: %s\n",
-+ fullPath, strerror(errno));
-+ goto next1;
++ filepath, strerror(errno));
++ return -1;
+ }
-+ ret = fstat(fd, &st);
-+ if (ret == -1) {
++
++ if (fstat(fd, &st) == -1) {
+ rpmlog(RPMLOG_ERR, "fstat failed for %s: %s\n",
-+ fullPath, strerror(errno));
-+ goto next;
++ filepath, strerror(errno));
++ close(fd);
++ return -1;
+ }
-+ if (file->ino && (st.st_ino != file->ino)) {
-+ rpmlog(RPMLOG_ERR, "Inode check failed for %s\n", fullPath);
-+ goto next;
-+ }
+
-+ rpmlog(RPMLOG_INFO, "setting SMACK64 %s for %s\n", label, fullPath);
-+ ret = fsetxattr(fd, SMACK64, label, strlen(label), 0);
-+ if (ret < 0) {
++ rpmlog(RPMLOG_INFO, "setting SMACK64 %s for %s\n", label, filepath);
++
++ if (fsetxattr(fd, SMACK64, label, strlen(label), 0) < 0 ) {
+ rpmlog(RPMLOG_ERR, "Failed to set SMACK64 %s for %s: %s\n",
-+ label, fullPath, strerror(errno));
++ label, filepath, strerror(errno));
+ }
+
-+ if ((is_executable(fullPath)) == 0) {
++ if ((is_executable(filepath)) == 0) {
+ if ((exec_label) && (strcmp(exec_label, "none") == 0)) {
+ // do not set SMACK64EXEC
-+ rpmlog(RPMLOG_INFO, "not setting SMACK64EXEC for %s as requested in manifest\n", fullPath);
++ rpmlog(RPMLOG_INFO, "not setting SMACK64EXEC for %s as requested in manifest\n", filepath);
+ } else {
-+ rpmlog(RPMLOG_INFO, "setting SMACK64EXEC %s for %s\n", exec_label, fullPath);
-+ ret = fsetxattr(fd, SMACK64EXEC, exec_label, strlen(exec_label), 0);
-+ if (ret < 0) {
++ rpmlog(RPMLOG_INFO, "setting SMACK64EXEC %s for %s\n", exec_label, filepath);
++ if ( fsetxattr(fd, SMACK64EXEC, exec_label, strlen(exec_label), 0) < 0 ) {
+ rpmlog(RPMLOG_ERR, "Failed to set SMACK64EXEC %s for %s: %s\n",
-+ exec_label, fullPath, strerror(errno));
++ exec_label, filepath, strerror(errno));
+ }
+ }
+ }
+
-+ if (type) { //marked as transmutable
++ if (type) { //marked as transmutable+
+ if (S_ISDIR(st.st_mode)) { //check that it is a directory
-+ char at_true[]="TRUE";
-+ rpmlog(RPMLOG_INFO, "setting SMACK64TRANSMUTE %s for %s\n", at_true, fullPath);
-+ ret = fsetxattr(fd, SMACK64TRANSMUTE, at_true, strlen(at_true), 0);
-+ if (ret < 0) {
++ char at_true[] = "TRUE";
++ rpmlog(RPMLOG_INFO, "setting SMACK64TRANSMUTE %s for %s\n", at_true, filepath);
++ if ( fsetxattr(fd, SMACK64TRANSMUTE, at_true, strlen(at_true), 0) < 0 ) {
+ rpmlog(RPMLOG_ERR, "Failed to set SMACK64TRANSMUTE %s for %s: %s\n",
-+ at_true, fullPath, strerror(errno));
++ at_true, filepath, strerror(errno));
+ }
+ } else {
+ rpmlog(RPMLOG_DEBUG, "No setting up of transmute attr for a non-directory, path %s\n",
-+ fullPath);
++ filepath);
+ }
+
+ }
+
-+ next:
-+ close(fd);
++ close(fd);
++
+
-+ next1:
-+ label = NULL;
-+ exec_label = NULL;
-+ if ((rootDir) && (strcmp(rootDir, "/") != 0)) {
-+ msmFreePointer((void**)&fullPath);
-+ }
+
-+ }
+ return 0;
++
+}
+
++
+#if 0
+
+static void msmRemoveObjectRules(SmackRuleSet rule_set, const char *name, package_x *package )
@@ -5503,7 +5483,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
+
diff -Nuarp rpm/security/security.h rpm-security/security/security.h
--- rpm/security/security.h 1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/security.h 2012-07-24 12:27:43.031952220 +0300
++++ rpm-security/security/security.h 2012-08-06 12:49:34.381011684 +0300
@@ -0,0 +1,25 @@
+#include "system.h"
+
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 09:46:48 +0000