Attachment 310018 Details for Bug 390691 – proposed upstream patch

[patch] proposed upstream patch

0001-mount-warn-on-file_t-selinux-context.patch (text/plain), 1.95 KB, created by Karel Zak on 2008-06-23 11:08:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Karel Zak

Created: 2008-06-23 11:08:28 UTC

Size: 1.95 KB

patch

obsolete

>From 739885cea1768a57a5d6998b9010bf9ef3674c65 Mon Sep 17 00:00:00 2001
>From: Karel Zak <kzak@redhat.com>
>Date: Mon, 23 Jun 2008 13:00:00 +0200
>Subject: [PATCH] mount: warn on "file_t" selinux context
>
>Currently if I mount a file system without labels, it works fine, but
>later or SELinux will start printing denials and stopping certain
>applications from working. It would be nice if the mount command
>checked it in selinux mode.
>
>Addresses-Red-Hat-Bugzilla: #390691
>Signed-off-by: Karel Zak <kzak@redhat.com>
>---
> mount/mount.c |   25 +++++++++++++++++++++++++
> 1 files changed, 25 insertions(+), 0 deletions(-)
>
>diff --git a/mount/mount.c b/mount/mount.c
>index bed792d..0fd6ae8 100644
>--- a/mount/mount.c
>+++ b/mount/mount.c
>@@ -1370,6 +1370,31 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
>   res = EX_FAIL;
> 
>  out:
>+
>+#ifdef HAVE_LIBSELINUX
>+  if (res != EX_FAIL && is_selinux_enabled()) {
>+      security_context_t raw;
>+
>+      if (getfilecon(node, &raw) > 0) {
>+	  context_t cxt = context_new(raw);
>+	  const char *type = cxt ? context_type_get(cxt) : NULL;
>+
>+	  if (type && strcmp(type, "file_t") == 0)
>+	      printf(_("mount: %s does not contain SELinux labels.\n"
>+                   "       You just mounted an file system that supports labels which does not\n"
>+                   "       contain labels, onto an SELinux box. It is likely that confined\n"
>+                   "       applications will generate AVC messages and not be allowed access to\n"
>+                   "       this file system.  You can add labels to this file system by executing\n"
>+                   "       restorecon(8). If you do not want to add labels to this file system,\n"
>+                   "       you should mount the file system using one of the \"context\" mount\n"
>+                   "       option."), node);
>+	  if (cxt)
>+		context_free(cxt);
>+	  freecon(raw);
>+      }
>+  }
>+#endif
>+
>   my_free(extra_opts1);
>   my_free(spec1);
>   my_free(node1);
>-- 
>1.5.4.1
>

Actions: View | Diff

Attachments on bug 390691: 310018 | 310274