Fixed location of file, removed hiddendef and hiddenproto.
This patch provide an libselinux call to check if dontaudit rules are
disabled after rebuilding policy. It also includes a libsemange call to
check if dontaudit rules will be disabled after policy rebuild. This
functionality is required firstly by administrators who wish to know if
dontaudit rules are disabled, secondly by programs which will
manipulate this data and may want to check it's settings.
Signed-off-by Christopher Pardy <cpardy@xxxxxxxxxx>
diff -urN selinux.orig2/libselinux/include/selinux/selinux.h selinux/libselinux/include/selinux/selinux.h
--- selinux.orig2/libselinux/include/selinux/selinux.h 2009-07-01 21:15:17.009238289 -0400
+++ selinux/libselinux/include/selinux/selinux.h 2009-07-01 21:44:57.264509874 -0400
@@ -8,6 +8,9 @@
extern "C" {
#endif
+/* Return 1 if the dont audit rules have been turned off or 0 if not. */
+extern int is_dontaudit_disabled(void);
+
/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
extern int is_selinux_enabled(void);
/* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */
diff -urN selinux.orig2/libselinux/src/dontaudit.c selinux/libselinux/src/dontaudit.c
--- selinux.orig2/libselinux/src/dontaudit.c 1969-12-31 19:00:00.000000000 -0500
+++ selinux/libselinux/src/dontaudit.c 2009-07-01 21:48:48.635521208 -0400
@@ -0,0 +1,21 @@
+#include<unistd.h>
+#include<selinux/selinux.h>
+#include "selinux_internal.h"
+#include<stdlib.h>
+#include<limits.h>
+#include<stdarg.h>
+#include<stdio.h>
+#include<string.h>
+
+int is_dontaudit_disabled(void)
+{
+ char path[PATH_MAX];
+ snprintf(path,PATH_MAX,"%s/disable_dontaudit",selinux_policy_root());
+
+ if (access(path,F_OK) == 0)
+ return 1;
+ else
+ return 0;
+}
+
+hidden_def(is_dontaudit_disabled)
diff -urN selinux.orig2/libselinux/src/selinux_internal.h selinux/libselinux/src/selinux_internal.h
--- selinux.orig2/libselinux/src/selinux_internal.h 2009-07-01 21:15:17.074235819 -0400
+++ selinux/libselinux/src/selinux_internal.h 2009-07-01 21:44:57.272486689 -0400
@@ -24,6 +24,7 @@
hidden_proto(security_compute_create_raw)
hidden_proto(security_compute_member_raw)
hidden_proto(security_compute_relabel_raw)
+ hidden_proto(is_dontaudit_disabled)
hidden_proto(is_selinux_enabled)
hidden_proto(is_selinux_mls_enabled)
hidden_proto(freecon)
diff -urN selinux.orig2/libsemanage/include/semanage/handle.h selinux/libsemanage/include/semanage/handle.h
--- selinux.orig2/libsemanage/include/semanage/handle.h 2009-07-01 21:15:17.224235939 -0400
+++ selinux/libsemanage/include/semanage/handle.h 2009-07-01 21:44:57.274484577 -0400
@@ -69,6 +69,9 @@
* 1 for yes, 0 for no (default) */
void semanage_set_create_store(semanage_handle_t * handle, int create_store);
+/*Get whether or not to dontaudits will be disabled upon commit */
+int semanage_get_disable_dontaudit(semanage_handle_t * handle);
+
/* Set whether or not to disable dontaudits upon commit */
void semanage_set_disable_dontaudit(semanage_handle_t * handle, int disable_dontaudit);
diff -urN selinux.orig2/libsemanage/src/handle.c selinux/libsemanage/src/handle.c
--- selinux.orig2/libsemanage/src/handle.c 2009-07-01 21:15:17.288238017 -0400
+++ selinux/libsemanage/src/handle.c 2009-07-01 21:55:04.525487189 -0400
@@ -29,6 +29,7 @@
#include<stdio.h>
#include<string.h>
#include<sys/time.h>
+#include<limits.h>
#include "direct_api.h"
#include "handle.h"
@@ -58,6 +59,9 @@
if (!sh->sepolh)
goto err;
sepol_msg_set_callback(sh->sepolh, semanage_msg_relay_handler, sh);
+
+ /* Set the disable_dont audit to the system default */
+ semanage_set_disable_dontaudit(sh,is_dontaudit_disabled());
/* By default do not rebuild the policy on commit
* If any changes are made, this flag is ignored */
@@ -110,6 +114,14 @@
return;
}
+int semanage_get_disable_dontaudit(semanage_handle_t * sh)
+{
+ assert(sh != NULL);
+
+ return sepol_get_disable_dontaudit(sh->sepolh);
+}
+
+
void semanage_set_disable_dontaudit(semanage_handle_t * sh, int disable_dontaudit)
{
assert(sh != NULL);
@@ -264,11 +276,22 @@
assert(sh != NULL&& sh->funcs != NULL&& sh->funcs->commit != NULL);
if (!sh->is_in_transaction) {
ERR(sh,
- "Will not commit because caller does not have a tranaction lock yet.");
+ "Will not commit because caller does not have a transaction lock yet.");
return -1;
}
retval = sh->funcs->commit(sh);
sh->is_in_transaction = 0;
sh->modules_modified = 0;
+ if (retval == 0){
+ char path[PATH_MAX];
+ snprintf(path,PATH_MAX,"%s/disable_dontaudit",selinux_policy_root());
+ if(semanage_get_disable_dontaudit(sh) == 1){
+ FILE *touch;
+ touch = fopen(path,"w");
+ fclose(touch);
+ }else{
+ remove(path);
+ }
+ }
return retval;
}
diff -urN selinux.orig2/libsemanage/src/libsemanage.map selinux/libsemanage/src/libsemanage.map
--- selinux.orig2/libsemanage/src/libsemanage.map 2009-07-01 21:15:17.290237650 -0400
+++ selinux/libsemanage/src/libsemanage.map 2009-07-01 21:44:57.278485521 -0400
@@ -15,7 +15,7 @@
semanage_iface_*; semanage_port_*; semanage_context_*;
semanage_node_*;
semanage_fcontext_*; semanage_access_check; semanage_set_create_store;
- semanage_is_connected; semanage_set_disable_dontaudit;
+ semanage_is_connected; semanage_get_disable_dontaudit; semanage_set_disable_dontaudit;
semanage_mls_enabled;
local: *;
};
diff -urN selinux.orig2/libselinux/include/selinux/selinux.h selinux/libselinux/include/selinux/selinux.h
--- selinux.orig2/libselinux/include/selinux/selinux.h 2009-07-01 21:15:17.009238289 -0400
+++ selinux/libselinux/include/selinux/selinux.h 2009-07-01 21:44:57.264509874 -0400
@@ -8,6 +8,9 @@
extern "C" {
#endif
+/* Return 1 if the dont audit rules have been turned off or 0 if not. */
+extern int is_dontaudit_disabled(void);
+
/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
extern int is_selinux_enabled(void);
/* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */
diff -urN selinux.orig2/libselinux/src/dontaudit.c selinux/libselinux/src/dontaudit.c
--- selinux.orig2/libselinux/src/dontaudit.c 1969-12-31 19:00:00.000000000 -0500
+++ selinux/libselinux/src/dontaudit.c 2009-07-01 21:48:48.635521208 -0400
@@ -0,0 +1,21 @@
+#include <unistd.h>
+#include <selinux/selinux.h>
+#include "selinux_internal.h"
+#include <stdlib.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
+
+int is_dontaudit_disabled(void)
+{
+ char path[PATH_MAX];
+ snprintf(path,PATH_MAX,"%s/modules/disable_dontaudit",selinux_policy_root());
+
+ if (access(path,F_OK) == 0)
+ return 1;
+ else
+ return 0;
+}
+
diff -urN selinux.orig2/libsemanage/include/semanage/handle.h selinux/libsemanage/include/semanage/handle.h
--- selinux.orig2/libsemanage/include/semanage/handle.h 2009-07-01 21:15:17.224235939 -0400
+++ selinux/libsemanage/include/semanage/handle.h 2009-07-01 21:44:57.274484577 -0400
@@ -69,6 +69,9 @@
* 1 for yes, 0 for no (default) */
void semanage_set_create_store(semanage_handle_t * handle, int create_store);
+/*Get whether or not to dontaudits will be disabled upon commit */
+int semanage_get_disable_dontaudit(semanage_handle_t * handle);
+
/* Set whether or not to disable dontaudits upon commit */
void semanage_set_disable_dontaudit(semanage_handle_t * handle, int disable_dontaudit);
diff -urN selinux.orig2/libsemanage/src/handle.c selinux/libsemanage/src/handle.c
--- selinux.orig2/libsemanage/src/handle.c 2009-07-01 21:15:17.288238017 -0400
+++ selinux/libsemanage/src/handle.c 2009-07-01 21:55:04.525487189 -0400
@@ -29,6 +29,7 @@
#include <stdio.h>
#include <string.h>
#include <sys/time.h>
+#include <limits.h>
#include "direct_api.h"
#include "handle.h"
@@ -58,6 +59,9 @@
if (!sh->sepolh)
goto err;
sepol_msg_set_callback(sh->sepolh, semanage_msg_relay_handler, sh);
+
+ /* Set the disable_dont audit to the system default */
+ semanage_set_disable_dontaudit(sh,is_dontaudit_disabled());
/* By default do not rebuild the policy on commit
* If any changes are made, this flag is ignored */
@@ -110,6 +114,14 @@
return;
}
+int semanage_get_disable_dontaudit(semanage_handle_t * sh)
+{
+ assert(sh != NULL);
+
+ return sepol_get_disable_dontaudit(sh->sepolh);
+}
+
+
void semanage_set_disable_dontaudit(semanage_handle_t * sh, int disable_dontaudit)
{
assert(sh != NULL);
@@ -264,11 +276,22 @@
assert(sh != NULL && sh->funcs != NULL && sh->funcs->commit != NULL);
if (!sh->is_in_transaction) {
ERR(sh,
- "Will not commit because caller does not have a tranaction lock yet.");
+ "Will not commit because caller does not have a transaction lock yet.");
return -1;
}
retval = sh->funcs->commit(sh);
sh->is_in_transaction = 0;
sh->modules_modified = 0;
+ if (retval == 0){
+ char path[PATH_MAX];
+ snprintf(path,PATH_MAX,"%s/modules/disable_dontaudit",selinux_policy_root());
+ if(semanage_get_disable_dontaudit(sh) == 1){
+ FILE *touch;
+ touch = fopen(path,"w");
+ fclose(touch);
+ }else{
+ remove(path);
+ }
+ }
return retval;
}
diff -urN selinux.orig2/libsemanage/src/libsemanage.map selinux/libsemanage/src/libsemanage.map
--- selinux.orig2/libsemanage/src/libsemanage.map 2009-07-01 21:15:17.290237650 -0400
+++ selinux/libsemanage/src/libsemanage.map 2009-07-01 21:44:57.278485521 -0400
@@ -15,7 +15,7 @@
semanage_iface_*; semanage_port_*; semanage_context_*;
semanage_node_*;
semanage_fcontext_*; semanage_access_check; semanage_set_create_store;
- semanage_is_connected; semanage_set_disable_dontaudit;
+ semanage_is_connected; semanage_get_disable_dontaudit; semanage_set_disable_dontaudit;
semanage_mls_enabled;
local: *;
};
