If there are no local boolean or user files present, then the libselinux
load policy logic can disable setlocaldefs early and thus avoid creating
a writable mapping of the policy as well as avoiding the overhead of
calling the sepol functions for manipulating local boolean and user
files altogether. This is cleaner than changing the default for the
config option, as it will fall back to compatibility behavior for older
distributions. Thus, this change should not change behavior for RHEL 4.
Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
---
libselinux/src/load_policy.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
Index: trunk/libselinux/src/load_policy.c
===================================================================
--- trunk/libselinux/src/load_policy.c (revision 2790)
+++ trunk/libselinux/src/load_policy.c (working copy)
@@ -47,6 +47,7 @@
{
int kernvers = security_policyvers();
int vers = kernvers, minvers = DEFAULT_POLICY_VERSION;
+ int setlocaldefs = load_setlocaldefs;
char path[PATH_MAX], **names;
struct stat sb;
struct utsname uts;
@@ -131,13 +132,29 @@
minvers = vers_min();
}
+ /*
+ * Check whether we need to support local boolean and user definitions.
+ */
+ if (setlocaldefs) {
+ if (access(selinux_booleans_path(), F_OK) == 0)
+ goto checkbool;
+ snprintf(path, sizeof path, "%s.local", selinux_booleans_path());
+ if (access(path, F_OK) == 0)
+ goto checkbool;
+ snprintf(path, sizeof path, "%s/local.users", selinux_users_path());
+ if (access(path, F_OK) == 0)
+ goto checkbool;
+ /* No local definition files, so disable setlocaldefs. */
+ setlocaldefs = 0;
+ }
+checkbool:
/*
* As of Linux 2.6.22, the kernel preserves boolean
* values across a reload, so we do not need to
* preserve them in userspace.
*/
- if (uname(&uts) == 0 && strverscmp(uts.release, "2.6.22") >= 0)
+ if (preservebools && uname(&uts) == 0 && strverscmp(uts.release, "2.6.22") >= 0)
preservebools = 0;
search:
@@ -158,7 +175,7 @@
goto close;
prot = PROT_READ;
- if (load_setlocaldefs || preservebools)
+ if (setlocaldefs || preservebools)
prot |= PROT_WRITE;
size = sb.st_size;
@@ -195,7 +212,7 @@
}
if (usesepol) {
- if (load_setlocaldefs) {
+ if (setlocaldefs) {
void *olddata = data;
size_t oldsize = size;
rc = genusers(olddata, oldsize, selinux_users_path(),
@@ -228,7 +245,7 @@
free(names[i]);
free(names);
}
- } else if (load_setlocaldefs) {
+ } else if (setlocaldefs) {
(void)genbools(data, size,
(char *)selinux_booleans_path());
}
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
