diff options
Diffstat (limited to 'secmds/replcon.cc')
| -rw-r--r-- | secmds/replcon.cc | 358 |
1 files changed, 358 insertions, 0 deletions
diff --git a/secmds/replcon.cc b/secmds/replcon.cc new file mode 100644 index 0000000..34f7c1a --- /dev/null +++ b/secmds/replcon.cc @@ -0,0 +1,358 @@ +/** + * @file + * + * A tool for replacing file contexts in SELinux. + * + * @author Jeremy A. Mowery jmowery@tresys.com + * @author Jason Tang jtang@tresys.com + * + * Copyright (C) 2003-2007 Tresys Technology, LLC + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <config.h> + +#include <sefs/filesystem.hh> +#include <sefs/query.hh> +#include <selinux/selinux.h> +#include <apol/util.h> + +using namespace std; + +#include <assert.h> +#include <errno.h> +#include <getopt.h> +#include <iostream> +#include <stdlib.h> + +#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" + +enum OPTIONS +{ + OPTION_CONTEXT = 256 +}; + +static struct option const longopts[] = { + {"class", required_argument, NULL, 'c'}, + {"type", required_argument, NULL, 't'}, + {"user", required_argument, NULL, 'u'}, + {"role", required_argument, NULL, 'r'}, + {"mls-range", required_argument, NULL, 'm'}, + {"path", required_argument, NULL, 'p'}, + {"regex", no_argument, NULL, 'R'}, + {"context", required_argument, NULL, OPTION_CONTEXT}, + {"verbose", no_argument, NULL, 'v'}, + {"help", no_argument, NULL, 'h'}, + {"version", no_argument, NULL, 'V'}, + {NULL, 0, NULL, 0} +}; + +extern int lsetfilecon_raw(const char *, security_context_t) __attribute__ ((weak)); + +/** + * As that setools must work with older libselinux versions that may + * not have the _raw() functions, declare them as weak. If libselinux + * does indeed have the new functions then use them; otherwise + * fallback to the originals. + */ +static int replcon_lsetfilecon(const char *path, security_context_t context) +{ + if (lsetfilecon_raw != NULL) + { + return lsetfilecon_raw(path, context); + } + else + { + return lsetfilecon(path, context); + } +} + +struct replcon_info +{ + bool verbose, mls; + apol_context_t *replcon; +}; + +static void usage(const char *program_name, bool brief) +{ + cout << "Usage: " << program_name << " NEW_CONTEXT DIR [OPTIONS] [EXPRESSION]" << endl << endl; + if (brief) + { + cout << "\tTry " << program_name << " --help for more help." << endl << endl; + return; + } + + cout << "Replace SELinux file contexts for files matching a given context." << endl << endl; + + cout << "REQUIRED ARGUMENTS :" << endl; + cout << " NEW_CONTEXT partial or full context to relabel" << endl; + cout << " DIR starting directory to replace" << endl; + cout << endl; + cout << "EXPRESSION:" << endl; + cout << " -t TYPE, --type=TYPE find contexts with type TYPE" << endl; + cout << " -u USER, --user=USER find contexts with user USER" << endl; + cout << " -r ROLE, --role=ROLE find contexts with role ROLE" << endl; + cout << " -m RANGE, --mls-range=RANGE find contexts with MLS range RANGE" << endl; + cout << " --context=CONTEXT partial or full context to find" << endl; + cout << " (overrides expression options above)" << endl; + cout << " -p PATH, --path=PATH find files in PATH" << endl; + cout << " -c CLASS, --class=CLASS find files of object class CLASS" << endl; + cout << endl; + + cout << "OPTIONS:" << endl; + cout << " -R, --regex enable regular expressions" << endl; + cout << " -v, --verbose show context of matching files" << endl; + cout << " -h, --help print this help text and exit" << endl; + cout << " -V, --version print version information and exit" << endl; + cout << endl; + cout << "If the fclist does not contain MLS ranges and -m was given," << endl; + cout << "then the search will return nothing." << endl; + cout << endl; + cout << "NEW_CONTEXT is as a colon separated list of user, role, type, and MLS range" << endl; + cout << "such as follows: user_u:object_r:user_t:s0. If a field is not specified," << endl; + cout << "that portion of the context will not be replaced." << endl; + cout << "Examples:" << endl; + cout << " replcon ::type_t: ." << endl; + cout << " Replace all files and subdirectories in current directory with" << endl; + cout << " type type_t, recursing within the directory." << endl; + cout << " replcon -u user_u *:role_r:* ." << endl; + cout << " Replace files that contain user_u with role role_r." << endl; + cout << " replcon --context ::type_t:so :::s0:c0 /tmp" << endl; + cout << " Replace files with type type_t and level s0 in /tmp with MLS" << endl; + cout << " range s0:c0." << endl; +} + +static int replace_entry(sefs_fclist * fclist, const sefs_entry * e, void *arg) +{ + struct replcon_info *r = static_cast < struct replcon_info *>(arg); + const apol_context_t *scon = e->context(); + const char *user, *role, *type; + char *con_str = NULL; + size_t len = 0; + + // determine what the new context should be + if ((user = apol_context_get_user(r->replcon)) == NULL) + { + user = apol_context_get_user(scon); + } + if ((role = apol_context_get_role(r->replcon)) == NULL) + { + role = apol_context_get_role(scon); + } + if ((type = apol_context_get_type(r->replcon)) == NULL) + { + type = apol_context_get_type(scon); + } + if (apol_str_appendf(&con_str, &len, "%s:%s:%s", user, role, type) < 0) + { + return -1; + } + if (r->mls) + { + const apol_mls_range_t *apol_range = NULL; + char *range = NULL; + if ((apol_range = apol_context_get_range(r->replcon)) == NULL) + { + apol_range = apol_context_get_range(scon); + } + if ((range = apol_mls_range_render(NULL, apol_range)) == NULL || apol_str_appendf(&con_str, &len, ":%s", range) < 0) + { + free(range); + free(con_str); + return -1; + } + free(range); + } + + if (r->verbose) + { + char *lcon = NULL, *rcon = NULL; + if (r->mls) + { + lcon = apol_context_render(NULL, r->replcon); + rcon = apol_context_render(NULL, scon); + } + else + { + if (asprintf(&lcon, "%s:%s:%s", + apol_context_get_user(r->replcon), + apol_context_get_role(r->replcon), apol_context_get_type(r->replcon)) < 0) + { + lcon = NULL; + } + if (asprintf(&rcon, "%s:%s:%s", + apol_context_get_user(scon), apol_context_get_role(scon), apol_context_get_type(scon)) < 0) + { + rcon = NULL; + } + } + if (lcon == NULL || rcon == NULL) + { + free(lcon); + free(rcon); + return -1; + } + printf("%s: %s --> %s\n", e->path(), lcon, rcon); + free(lcon); + free(rcon); + } + + // until there is a way to create a security_context_t from a + // char *, simply perform the implicit cast below + if (replcon_lsetfilecon(e->path(), con_str) != 0) + { + cerr << "Could not set context " << con_str << " for file " << e->path() << "." << endl; + free(con_str); + return -1; + } + + free(con_str); + return 0; +} + +int main(int argc, char *argv[]) +{ + int optc; + struct replcon_info r; + + r.verbose = false; + r.replcon = NULL; + sefs_query *query = new sefs_query(); + + apol_context_t *context = NULL; + try + { + while ((optc = getopt_long(argc, argv, "t:u:r:m:p:c:RvhV", longopts, NULL)) != -1) + { + switch (optc) + { + case 't': + if (context == NULL) + { + query->type(optarg, false); + } + break; + case 'u': + if (context == NULL) + { + query->user(optarg); + } + break; + case 'r': + if (context == NULL) + { + query->role(optarg); + } + break; + case 'm': + if (context == NULL) + { + query->range(optarg, APOL_QUERY_EXACT); + } + break; + case OPTION_CONTEXT: + if ((context = apol_context_create_from_literal(optarg)) == NULL) + { + cerr << "Could not create source context." << endl; + throw runtime_error(strerror(errno)); + } + break; + case 'p': + query->path(optarg); + break; + case 'c': + query->objectClass(optarg); + break; + case 'R': + query->regex(true); + break; + case 'v': + r.verbose = true; + break; + case 'h': // help + usage(argv[0], false); + exit(0); + case 'V': // version + cout << "replcon " << VERSION << endl << COPYRIGHT_INFO << endl; + exit(0); + default: + usage(argv[0], true); + exit(1); + } + if (context != NULL) + { + query->user(apol_context_get_user(context)); + query->role(apol_context_get_role(context)); + query->type(apol_context_get_type(context), false); + if (apol_context_get_range(context) != NULL) + { + char *rng = apol_mls_range_render(NULL, apol_context_get_range(context)); + query->range(rng, APOL_QUERY_EXACT); + free(rng); + } + else + { + query->range(NULL, APOL_QUERY_EXACT); + } + } + } + } + catch(bad_alloc) + { + cerr << strerror(errno) << endl; + apol_context_destroy(&context); + delete query; + exit(-1); + } + apol_context_destroy(&context); + + if (optind + 2 != argc) + { + usage(argv[0], 1); + delete query; + exit(-1); + } + + sefs_fclist *fclist = NULL; + try + { + fclist = new sefs_filesystem(argv[optind + 1], NULL, NULL); + r.mls = fclist->isMLS(); + + if ((r.replcon = apol_context_create_from_literal(argv[optind])) == NULL) + { + cerr << "Could not create replacement context." << endl; + throw runtime_error(strerror(errno)); + } + + if (fclist->runQueryMap(query, replace_entry, &r) < 0) + { + throw runtime_error(strerror(errno)); + } + } + catch(...) + { + delete query; + delete fclist; + apol_context_destroy(&(r.replcon)); + exit(-1); + } + + delete query; + delete fclist; + apol_context_destroy(&(r.replcon)); + return 0; +} |