1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
/* libguestfs - the guestfsd daemon
* Copyright (C) 2016 Red Hat Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "guestfs_protocol.h"
#include "daemon.h"
#include "actions.h"
#include "optgroups.h"
#include "ignore-value.h"
#define MAX_ARGS 64
int
optgroup_selinuxrelabel_available (void)
{
return prog_exists ("setfiles");
}
static int
setfiles_has_m_option (void)
{
static int flag = -1;
CLEANUP_FREE char *err = NULL;
if (flag == -1) {
ignore_value (command (NULL, &err, "setfiles", "-m", NULL));
flag = err && strstr (err, /* "invalid option -- " */ "'m'") == NULL;
}
return flag;
}
/* Takes optional arguments, consult optargs_bitmask. */
int
do_selinux_relabel (const char *specfile, const char *path,
int force)
{
const char *argv[MAX_ARGS];
CLEANUP_FREE char *s_dev = NULL, *s_proc = NULL, *s_selinux = NULL,
*s_sys = NULL, *s_specfile = NULL, *s_path = NULL;
CLEANUP_FREE char *err = NULL;
size_t i = 0;
s_dev = sysroot_path ("/dev");
if (!s_dev) {
malloc_error:
reply_with_perror ("malloc");
return -1;
}
s_proc = sysroot_path ("/proc"); if (!s_proc) goto malloc_error;
s_selinux = sysroot_path ("/selinux"); if (!s_selinux) goto malloc_error;
s_sys = sysroot_path ("/sys"); if (!s_sys) goto malloc_error;
s_specfile = sysroot_path (specfile); if (!s_specfile) goto malloc_error;
s_path = sysroot_path (path); if (!s_path) goto malloc_error;
/* Default settings if not selected. */
if (!(optargs_bitmask & GUESTFS_SELINUX_RELABEL_FORCE_BITMASK))
force = 0;
/* If setfiles takes an excessively long time to run (but still
* completes) then removing .../contexts/files/file_contexts.bin
* appears to help. If you find any such cases, please add
* observations to the bug report:
* https://bugzilla.redhat.com/show_bug.cgi?id=1396297
*/
ADD_ARG (argv, i, "setfiles");
if (force)
ADD_ARG (argv, i, "-F");
/* Exclude some directories that should never be relabelled in
* ordinary Linux guests. These won't be mounted anyway. We have
* to prefix all these with the sysroot path.
*/
ADD_ARG (argv, i, "-e"); ADD_ARG (argv, i, s_dev);
ADD_ARG (argv, i, "-e"); ADD_ARG (argv, i, s_proc);
ADD_ARG (argv, i, "-e"); ADD_ARG (argv, i, s_selinux);
ADD_ARG (argv, i, "-e"); ADD_ARG (argv, i, s_sys);
/* You have to use the -m option (where available) otherwise
* setfiles puts all the mountpoints on the excludes list for no
* useful reason (RHBZ#1433577).
*/
if (setfiles_has_m_option ())
ADD_ARG (argv, i, "-m");
/* Relabelling in a chroot. */
if (STRNEQ (sysroot, "/")) {
ADD_ARG (argv, i, "-r");
ADD_ARG (argv, i, sysroot);
}
if (verbose)
ADD_ARG (argv, i, "-v");
else
/* Suppress non-error output. */
ADD_ARG (argv, i, "-q");
/* Add parameters. */
ADD_ARG (argv, i, s_specfile);
ADD_ARG (argv, i, s_path);
ADD_ARG (argv, i, NULL);
if (commandv (NULL, &err, argv) == -1) {
reply_with_error ("%s", err);
return -1;
}
return 0;
}
|
