From 537a83d66c6597687ff4ad2952902bc99ed1546b Mon Sep 17 00:00:00 2001 From: Tomas Halman Date: Jul 23 2021 09:03:05 +0000 Subject: [PATCH 1/2] selinux: replace deprecated items There are compilation warnings in libuser regarding deprecated selinux structures and calls. This patch updates the code to get rid of those warnings. --- diff --git a/apps/apputil.c b/apps/apputil.c index 7413ab5..67663a2 100644 --- a/apps/apputil.c +++ b/apps/apputil.c @@ -38,7 +38,7 @@ static int check_access(const char *chuser, access_vector_t access) { int status; - security_context_t user_context; + char * user_context; status = -1; if (getprevcon(&user_context) == 0) { @@ -225,7 +225,7 @@ lu_authenticate_unprivileged(struct lu_context *ctx, const char *user, class = string_to_security_class("passwd"); perm = string_to_av_perm(class, "chfn"); if (check_access(user, perm) != 0) { - security_context_t user_context; + char *user_context; if (getprevcon(&user_context) < 0) user_context = NULL; diff --git a/lib/user_private.h b/lib/user_private.h index 02b813c..7cfb2d5 100644 --- a/lib/user_private.h +++ b/lib/user_private.h @@ -308,10 +308,10 @@ char *lu_util_default_salt_specifier(struct lu_context *context); /* Handle SELinux fscreate context. Note that modules built WITH_SELINUX are intentionally not compatible with libuser built !WITH_SELINUX. */ #ifdef WITH_SELINUX -typedef security_context_t lu_security_context_t; -gboolean lu_util_fscreate_save(security_context_t *ctx, +typedef char * lu_security_context_t; +gboolean lu_util_fscreate_save(char **ctx, struct lu_error **error); -void lu_util_fscreate_restore(security_context_t ctx); +void lu_util_fscreate_restore(char *ctx); gboolean lu_util_fscreate_from_fd(int fd, const char *path, struct lu_error **error); gboolean lu_util_fscreate_from_file(const char *file, struct lu_error **error); diff --git a/lib/util.c b/lib/util.c index bba9420..9238276 100644 --- a/lib/util.c +++ b/lib/util.c @@ -11,7 +11,7 @@ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * - * You should have received a copy of the GNU Library General Public + * You should have received a copy of the GNU Library General Public * License along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ @@ -32,6 +32,7 @@ #include #ifdef WITH_SELINUX #include +#include #endif #define LU_DEFAULT_SALT_TYPE "$1$" #define LU_DEFAULT_SALT_LEN 8 @@ -745,7 +746,7 @@ lu_util_update_shadow_last_change(struct lu_ent *ent) #ifdef WITH_SELINUX /* Store current fscreate context to ctx. */ gboolean -lu_util_fscreate_save(security_context_t *ctx, struct lu_error **error) +lu_util_fscreate_save(char **ctx, struct lu_error **error) { *ctx = NULL; if (is_selinux_enabled() > 0 && getfscreatecon(ctx) < 0) { @@ -759,7 +760,7 @@ lu_util_fscreate_save(security_context_t *ctx, struct lu_error **error) /* Restore fscreate context from ctx, and free it. */ void -lu_util_fscreate_restore(security_context_t ctx) +lu_util_fscreate_restore(char *ctx) { if (is_selinux_enabled() > 0) { (void)setfscreatecon(ctx); @@ -773,7 +774,7 @@ gboolean lu_util_fscreate_from_fd(int fd, const char *path, struct lu_error **error) { if (is_selinux_enabled() > 0) { - security_context_t ctx; + char *ctx; if (fgetfilecon(fd, &ctx) < 0) { lu_error_new(error, lu_error_stat, @@ -799,7 +800,7 @@ gboolean lu_util_fscreate_from_file(const char *file, struct lu_error **error) { if (is_selinux_enabled() > 0) { - security_context_t ctx; + char *ctx; if (getfilecon(file, &ctx) < 0) { lu_error_new(error, lu_error_stat, @@ -825,7 +826,7 @@ gboolean lu_util_fscreate_from_lfile(const char *file, struct lu_error **error) { if (is_selinux_enabled() > 0) { - security_context_t ctx; + char *ctx; if (lgetfilecon(file, &ctx) < 0) { lu_error_new(error, lu_error_stat, @@ -852,9 +853,18 @@ lu_util_fscreate_for_path(const char *path, mode_t mode, struct lu_error **error) { if (is_selinux_enabled() > 0) { - security_context_t ctx; - - if (matchpathcon(path, mode, &ctx) < 0) { + char *ctx; + struct selabel_handle *label_handle = NULL; + + label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0); + if (!label_handle) { + lu_error_new(error, lu_error_open, + _("couldn't obtain selabel file " + "context handle: %s"), + strerror(errno)); + return FALSE; + } + if (selabel_lookup(label_handle, &ctx, path, mode) < 0) { if (errno == ENOENT) ctx = NULL; else { @@ -862,9 +872,11 @@ lu_util_fscreate_for_path(const char *path, mode_t mode, _("couldn't determine security " "context for `%s': %s"), path, strerror(errno)); + selabel_close(label_handle); return FALSE; } } + selabel_close(label_handle); if (setfscreatecon(ctx) < 0) { lu_error_new(error, lu_error_generic, _("couldn't set default security context " From 3cb7ea54e7b50da6ea313a0e7c7187c8aa5e6ee9 Mon Sep 17 00:00:00 2001 From: Tomas Halman Date: Jul 23 2021 09:03:05 +0000 Subject: [PATCH 2/2] python: Compilation warnings update The compilation produces few warnings about discard const qualifier and pointer to int conversion. This patch fixes the const qualifiers and replaces the tp_print inicialization in PyTypeObject with 0 instead of NULL --- diff --git a/python/admin.c b/python/admin.c index 83595af..e92fca4 100644 --- a/python/admin.c +++ b/python/admin.c @@ -1512,7 +1512,7 @@ PyTypeObject AdminType = { sizeof(struct libuser_admin), /* tp_basicsize */ 0, /* tp_itemsize */ libuser_admin_destroy, /* tp_dealloc */ - NULL, /* tp_print */ + 0, /* tp_print */ NULL, /* tp_getattr */ NULL, /* tp_setattr */ NULL, /* tp_compare */ diff --git a/python/ent.c b/python/ent.c index ee712d2..fc3d654 100644 --- a/python/ent.c +++ b/python/ent.c @@ -255,7 +255,7 @@ libuser_convert_to_value(PyObject *item, GValue *value) static int libuser_entity_setattro(PyObject *self, PyObject *attr_name, PyObject *value) { - char *name; + const char *name; struct libuser_entity *me; PyObject *list; struct lu_ent *copy; @@ -616,7 +616,7 @@ static PyObject * libuser_entity_get_item(PyObject *self, PyObject *item) { struct libuser_entity *me; - char *attr; + const char *attr; DEBUG_ENTRY; me = (struct libuser_entity *)self; @@ -664,7 +664,7 @@ static int libuser_entity_set_item(PyObject *self, PyObject *item, PyObject *args) { struct libuser_entity *me; - char *attr = NULL; + const char *attr = NULL; Py_ssize_t i, size; int ret; GValue value; @@ -800,7 +800,7 @@ PyTypeObject EntityType = { sizeof(struct libuser_entity), /* tp_basicsize */ 0, /* tp_itemsize */ libuser_entity_destroy, /* tp_dealloc */ - NULL, /* tp_print */ + 0, /* tp_print */ NULL, /* tp_getattr */ NULL, /* tp_setattr */ NULL, /* tp_compare */ diff --git a/python/misc.c b/python/misc.c index fcb0ccf..e74a5d4 100644 --- a/python/misc.c +++ b/python/misc.c @@ -493,7 +493,7 @@ PyTypeObject PromptType = { sizeof(struct libuser_prompt), /* tp_basicsize */ 0, /* tp_itemsize */ libuser_prompt_destroy, /* tp_dealloc */ - NULL, /* tp_print */ + 0, /* tp_print */ NULL, /* tp_getattr */ NULL, /* tp_setattr */ NULL, /* tp_compare */