Attachment 310274 Details for Bug 390691 – patch v2

[patch] patch v2

0001-mount-warn-on-file_t-selinux-context.patch (text/plain), 1.92 KB, created by Karel Zak on 2008-06-25 14:49:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Karel Zak

Created: 2008-06-25 14:49:08 UTC

Size: 1.92 KB

patch

obsolete

>From 5f440a4519ee8a60f2ce2c534618a987b0913097 Mon Sep 17 00:00:00 2001
>From: Karel Zak <kzak@redhat.com>
>Date: Mon, 23 Jun 2008 13:00:00 +0200
>Subject: [PATCH] mount: warn on "file_t" selinux context
>
>Currently if I mount a file system without labels, it works fine, but
>later or SELinux will start printing denials and stopping certain
>applications from working. It would be nice if the mount command
>checked it in selinux mode.
>
>Addresses-Red-Hat-Bugzilla: #390691
>Signed-off-by: Karel Zak <kzak@redhat.com>
>---
> mount/mount.c |   23 +++++++++++++++++++++++
> 1 files changed, 23 insertions(+), 0 deletions(-)
>
>diff --git a/mount/mount.c b/mount/mount.c
>index bed792d..581bbc5 100644
>--- a/mount/mount.c
>+++ b/mount/mount.c
>@@ -1370,6 +1370,29 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
>   res = EX_FAIL;
> 
>  out:
>+
>+#ifdef HAVE_LIBSELINUX
>+  if (res != EX_FAIL && is_selinux_enabled()) {
>+      security_context_t raw = NULL, def = NULL;
>+
>+      if (getfilecon(node, &raw) > 0 &&
>+		     security_get_initial_context("file", &def) > 0) {
>+
>+	  if (!selinux_file_context_cmp(raw, def))
>+	      printf(_("mount: %s does not contain SELinux labels.\n"
>+                   "       You just mounted an file system that supports labels which does not\n"
>+                   "       contain labels, onto an SELinux box. It is likely that confined\n"
>+                   "       applications will generate AVC messages and not be allowed access to\n"
>+                   "       this file system.  You can add labels to this file system by executing\n"
>+                   "       restorecon(8). If you do not want to add labels to this file system,\n"
>+                   "       you should mount the file system using one of the \"context\" mount\n"
>+                   "       option."), node);
>+      }
>+      freecon(raw);
>+      freecon(def);
>+  }
>+#endif
>+
>   my_free(extra_opts1);
>   my_free(spec1);
>   my_free(node1);
>-- 
>1.5.4.1
>

Actions: View | Diff

Attachments on bug 390691: 310018 | 310274