- fix selinux labels on $MOUNTPOINT/ and $MOUNTPOINT/lost+found (#335621)

2 files changed, 46 insertions, 16 deletions

diff --git a/isys/isys.c b/isys/isys.c
index d759a55b8..60e9a353d 100644
--- a/isys/isys.c
+++ b/isys/isys.c
@@ -108,7 +108,8 @@ static PyObject * py_isLdlDasd(PyObject * s, PyObject * args);
 static PyObject * doGetMacAddress(PyObject * s, PyObject * args);
 static PyObject * doGetIPAddress(PyObject * s, PyObject * args);
 #ifdef USESELINUX
-static PyObject * doResetFileContext(PyObject * s, PyObject * args);
+static PyObject * doMatchPathContext(PyObject * s, PyObject * args);
+static PyObject * doSetFileContext(PyObject * s, PyObject * args);
 #endif
 static PyObject * isWireless(PyObject * s, PyObject * args);
 static PyObject * doProbeBiosDisks(PyObject * s, PyObject * args);
@@ -159,7 +160,8 @@ static PyMethodDef isysModuleMethods[] = {
     { "getMacAddress", (PyCFunction) doGetMacAddress, METH_VARARGS, NULL},
     { "getIPAddress", (PyCFunction) doGetIPAddress, METH_VARARGS, NULL},
 #ifdef USESELINUX
-    { "resetFileContext", (PyCFunction) doResetFileContext, METH_VARARGS, NULL },
+    { "matchPathContext", (PyCFunction) doMatchPathContext, METH_VARARGS, NULL },
+    { "setFileContext", (PyCFunction) doSetFileContext, METH_VARARGS, NULL },
 #endif
     { "isWireless", (PyCFunction) isWireless, METH_VARARGS, NULL },
     { "biosDiskProbe", (PyCFunction) doProbeBiosDisks, METH_VARARGS,NULL},
@@ -1066,27 +1068,38 @@ static PyObject * doGetIPAddress(PyObject * s, PyObject * args) {
     return Py_BuildValue("s", ret);
 }
 #ifdef USESELINUX
-static PyObject * doResetFileContext(PyObject * s, PyObject * args) {
+static PyObject * doMatchPathContext(PyObject * s, PyObject * args) {
     char *fn, *buf = NULL;
+    int ret;
+
+    if (!PyArg_ParseTuple(args, "s", &fn))
+        return NULL;
+
+    ret = matchpathcon(fn, 0, &buf);
+    if (ret == 0)
+        return Py_BuildValue("s", buf);
+    
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+static PyObject * doSetFileContext(PyObject * s, PyObject * args) {
+    char *fn, *con;
     char * root = NULL;
     char path[PATH_MAX];
     int ret;
 
-    if (!PyArg_ParseTuple(args, "s|s", &fn, &root))
+    if (!PyArg_ParseTuple(args, "ss|s", &fn, &con, &root))
         return NULL;
 
-    ret = matchpathcon(fn, 0, &buf);
-    /*    fprintf(stderr, "matchpathcon returned %d: set %s to %s\n", ret, fn, buf);*/
-    if (ret == 0) {
-        if (root != NULL) 
-            snprintf(path, PATH_MAX, "%s/%s", root, fn);
-        else
-            snprintf(path, PATH_MAX, "%s", root);
-
-        ret = lsetfilecon(path, buf);
-    }
+    if (root != NULL) 
+        snprintf(path, PATH_MAX, "%s/%s", root, fn);
+    else
+        snprintf(path, PATH_MAX, "%s", root);
+
+    ret = lsetfilecon(path, con);
 
-    return Py_BuildValue("s", buf);
+    return Py_BuildValue("i", ret);
 }
 #endif
 static PyObject * py_getDasdPorts(PyObject * o, PyObject * args) {
diff --git a/isys/isys.py b/isys/isys.py
index cb3d67c96..5628f8a70 100644
--- a/isys/isys.py
+++ b/isys/isys.py
@@ -1079,11 +1079,28 @@ def isWireless(dev):
 def getIPAddress(dev):
     return _isys.getIPAddress(dev)
 
+## Get the correct context for a file from loaded policy.
+# @param fn The filename to query.
+def matchPathContext(fn):
+    return _isys.matchPathContext(fn)
+
+## Set the SELinux file context of a file
+# @param fn The filename to fix.
+# @param con The context to use.
+# @param instroot An optional root filesystem to look under for fn.
+def setFileContext(fn, con, instroot = '/'):
+    if con is not None and os.access("%s/%s" % (instroot, fn), os.F_OK):
+        return (_isys.setFileContext(fn, con, instroot) != 0)
+    return False
+
 ## Restore the SELinux file context of a file to its default.
 # @param fn The filename to fix.
 # @param instroot An optional root filesystem to look under for fn.
 def resetFileContext(fn, instroot = '/'):
-    return _isys.resetFileContext(fn, instroot)
+    con = matchPathContext(fn)
+    if con:
+        return setFileContext(fn, con, instroot)
+    return False
 
 def prefix2netmask(prefix):
     return _isys.prefix2netmask(prefix)