Bug 1395621 - selabel_lookup() with MEDIA backend does not return default removable context
Summary: selabel_lookup() with MEDIA backend does not return default removable context
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libselinux
Version: 7.4
Hardware: All
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Vit Mojzis
QA Contact: Jan Zarsky
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-16 10:07 UTC by Jan Zarsky
Modified: 2018-10-30 09:34 UTC (History)
7 users (show)

Fixed In Version: libselinux-2.5-13.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 09:34:40 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3084 0 None None None 2018-10-30 09:34:49 UTC

Description Jan Zarsky 2016-11-16 10:07:23 UTC
Description of problem:
Manpage of selabel_media (selabel_lookup() function with MEDIA backend) states "Should there not be a valid entry in the media file, then the default removable_context file will be read (see removable_context(5)).", but it does not work. When I create a custom contexts file with no valid entry and supply it through SELABEL_OPT_PATH to selabel_open, selabel_lookup then produces error instead of returning default removable_context.

Version-Release number of selected component (if applicable):
libselinux-2.5-6.el7.x86_64

Steps to Reproduce:
$ cat > bug.c <<EOF
#include <stdio.h>
#include <selinux/selinux.h>
#include <selinux/label.h>

char *custom_contexts_file = "my_contexts";

int main (int argc, char **argv)
{
    struct selabel_handle *hnd = NULL;
    security_context_t selabel_context;
    struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, custom_contexts_file } };

    if ((hnd = selabel_open(SELABEL_CTX_MEDIA, selabel_option, 4)) == NULL) {
        perror("selabel_open - ERROR");
        return 1;
    }

    if (selabel_lookup(hnd, &selabel_context, "floppy", 0) == -1) {
        perror("selabel_lookup - ERROR");
        selabel_close(hnd);
        return 1;
    }

    printf("%s\n", selabel_context);

    freecon(selabel_context);
    selabel_close(hnd);
    return 0;
}
EOF
$ gcc bug.c -o bug -lselinux
$ cat > my_contexts <<EOF
some_invalid_entry
EOF
$

Actual results:
$ ./bug
selabel_lookup - ERROR: No such file or directory
$

Expected results:
$ ./bug
system_u:object_r:removable_device_t:s0
$
(should match /etc/selinux/targeted/contexts/removable_context)

Additional info:
The other option is that the manpage is out of date and should be updated.

Comment 6 errata-xmlrpc 2018-10-30 09:34:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3084


Note You need to log in before you can comment on or make changes to this bug.