This is the upstream repository for the Security Enhanced Linux (SELinux) userland libraries and tools. The software provided by this project complements the SELinux features integrated into the Linux kernel and is used by Linux distributions. All bugs an
Go to file
Nicolas Iooss 689a6eb576 libselinux: do not dereference symlink with statfs in selinux_restorecon
When selinux_restorecon() is used to relabel symlinks, it performs the
following syscalls (as seen by running strace on restorecond):

    lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
    statfs("/root/symlink", 0x7ffd6bb4d090) = -1 ENOENT (No such file or directory)
    lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
    lgetxattr("/root/symlink", "security.selinux", "sysadm_u:object_r:user_home_t", 255) = 30

The second one triggers a SELinux check for lnk_file:read, as statfs()
dereferences symbolic links. This call to statfs() is only used to find
out whether "restoreconlast" xattr can be ignored, which is always the
case for non-directory files (the first syscall, lstat(), is actually
used to perform this check).

Skip the call to statfs() when setrestoreconlast is already false.

This silences an AVC denial that would otherwise be reported to
audit.log (cf. https://github.com/SELinuxProject/refpolicy/pull/22).

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-01-18 11:13:19 -05:00
checkpolicy checkpolicy: Add option to sort ocontexts when creating a binary policy 2018-10-12 13:38:00 -04:00
dbus dbus: remove deprecated at_console statement 2018-11-22 10:03:30 +01:00
gui gui: remove html_util.py 2018-11-22 10:03:49 +01:00
libselinux libselinux: do not dereference symlink with statfs in selinux_restorecon 2019-01-18 11:13:19 -05:00
libsemanage libsemanage: set selinux policy root around calls to selinux_boolean_sub 2019-01-12 19:01:24 +01:00
libsepol libsepol: ibpkeys.c: fix printf format string specifiers for subnet_prefix 2018-11-23 21:38:44 +01:00
mcstrans mcstrans: Fix check in raw_color() 2018-12-20 15:13:12 +01:00
policycoreutils setsebool: support use of -P on SELinux-disabled hosts 2019-01-17 13:56:05 -05:00
python python/sepolicy: initialize mislabeled_files in __init__() 2019-01-16 21:29:17 +01:00
restorecond restorecond: Do not ignore the -f option 2018-10-11 10:53:08 -04:00
sandbox Fix minor typos 2018-06-30 20:28:25 +02:00
scripts scripts/run-flake8: run on Python scripts not ending with .py 2019-01-08 13:21:09 +01:00
secilc secilc: better error handling 2018-09-25 08:05:41 -07:00
semodule-utils Update VERSIONs to 2.8 for release. 2018-05-24 14:21:09 -04:00
.gitignore restorecond: Add gitignore 2016-11-16 11:20:05 -05:00
.travis.yml Travis-CI: download refpolicy and install headers 2019-01-08 10:15:46 +01:00
CleanSpec.mk Add empty top level Android.mk / CleanSpec.mk files 2015-04-16 07:54:09 -04:00
Makefile build: setup buildpaths if DESTDIR is specified 2018-02-14 20:02:03 +01:00
README README: Update the SELinux mailing list location 2018-10-16 11:08:39 -04:00

Please submit all bug reports and patches to selinux@vger.kernel.org.
Subscribe by sending "subscribe selinux" in the body of an email
to majordomo@vger.kernel.org.

Build dependencies on Fedora:
yum install audit-libs-devel bison bzip2-devel dbus-devel dbus-glib-devel flex flex-devel flex-static glib2-devel libcap-devel libcap-ng-devel pam-devel pcre-devel python-devel setools-devel swig xmlto redhat-rpm-config

To build and install everything under a private directory, run:
make DESTDIR=~/obj install install-pywrap

To install as the default system libraries and binaries
(overwriting any previously installed ones - dangerous!),
on x86_64, run:
make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel
or on x86 (32-bit), run:
make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace
lacks library functions or other dependencies relied upon by your
distribution.  If it breaks, you get to keep both pieces.

To install libsepol on macOS (mainly for policy analysis):
cd libsepol; make PREFIX=/usr/local install

This requires GNU coreutils (brew install coreutils).