[prev in list] [next in list] [prev in thread] [next in thread] 

List:       busybox
Subject:    [PATCH] tar: add selinux context support on create (v7)
From:       Tanguy Pruvot <tanguy.pruvot () gmail ! com>
Date:       2014-05-20 10:58:52
Message-ID: CACOx48p+DKJ4G2c=xkTko99YUVFj11BvGhr=xi=xj13k6+ssjg () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


Added sanity check for context len.

for the flag, i think the existing -p could be nice.

http://review.cyanogenmod.org/#/c/64213/

[Attachment #5 (text/html)]

<div dir="ltr">Added sanity check for context len.<div><br></div><div><span \
style="color:rgb(53,53,53);font-family:sans-serif">for the flag, i think the existing \
-p could be nice.</span><br></div><div><span \
style="color:rgb(53,53,53);font-family:sans-serif"><br> </span></div><div><font \
color="#353535" face="sans-serif"><a \
href="http://review.cyanogenmod.org/#/c/64213/">http://review.cyanogenmod.org/#/c/64213/</a></font><br></div><div><font \
color="#353535" face="sans-serif"><br></font></div> </div>

--001a11346b54f5ac2004f9d2c392--


["0001-tar-add-selinux-context-support-on-create.patch" (application/octet-stream)]

From c63f56c0e998dd41e258cafa930a07e9cae9396b Mon Sep 17 00:00:00 2001
From: Tanguy Pruvot <tanguy.pruvot@gmail.com>
Date: Sat, 17 May 2014 17:27:40 +0200
Subject: [PATCH] tar: add selinux context support on create

No flag is required for the moment, it will add them
to the tar if selinux is enabled on the machine.

Signed-off-by: Tanguy Pruvot <tanguy.pruvot@gmail.com>

Change-Id: Ic7a39ee03087ed19e814b138ec6d70cdadb605cd
---
 archival/libarchive/data_extract_to_command.c |    2 +-
 archival/tar.c                                |   41 +++++++++++++++++++++++++
 include/bb_archive.h                          |    2 +-
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/archival/libarchive/data_extract_to_command.c \
b/archival/libarchive/data_extract_to_command.c index 5b32c2e..4249c23 100644
--- a/archival/libarchive/data_extract_to_command.c
+++ b/archival/libarchive/data_extract_to_command.c
@@ -63,7 +63,7 @@ void FAST_FUNC data_extract_to_command(archive_handle_t \
*archive_handle)  {
 	file_header_t *file_header = archive_handle->file_header;
 
-#if 0 /* do we need this? ENABLE_FEATURE_TAR_SELINUX */
+#if ENABLE_FEATURE_TAR_SELINUX
 	char *sctx = archive_handle->tar__sctx[PAX_NEXT_FILE];
 	if (!sctx)
 		sctx = archive_handle->tar__sctx[PAX_GLOBAL];
diff --git a/archival/tar.c b/archival/tar.c
index aa02d35..be2bb09 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -210,6 +210,7 @@ enum {
 	CONTTYPE = '7',		/* reserved */
 	GNULONGLINK = 'K',	/* GNU long (>100 chars) link name */
 	GNULONGNAME = 'L',	/* GNU long (>100 chars) file name */
+	EXTTYPE = 'x',		/* ext metadata for next file, store selinux_context */
 };
 
 /* Might be faster (and bigger) if the dev/ino were stored in numeric order;) */
@@ -351,6 +352,34 @@ static void writeLongname(int fd, int type, const char *name, \
int dir)  }
 #endif
 
+#if ENABLE_FEATURE_TAR_SELINUX
+# define SELINUX_CONTEXT_KEYWORD "RHT.security.selinux"
+/* Write 2 blocks : extended file header + selinux context */
+static int writeSeHeader(int fd, const char *con, struct tar_header_t *header)
+{
+	char block[TAR_BLOCK_SIZE];
+	struct tar_header_t hd;
+
+	int sz = sizeof(SELINUX_CONTEXT_KEYWORD) + 4 + strlen(con);
+	if (sz >= 100) sz++; /* another ascii digit for size */
+	if (sz > TAR_BLOCK_SIZE)
+		return FALSE;
+
+	memset(&block, 0, TAR_BLOCK_SIZE);
+	sprintf(block, "%d %s=%s\n", sz, SELINUX_CONTEXT_KEYWORD, con);
+
+	/* write duplicated file entry */
+	memcpy(&hd, header, sizeof(hd));
+	hd.typeflag = EXTTYPE;
+	PUT_OCTAL(hd.size, sz);
+	chksum_and_xwrite(fd, &hd);
+
+	/* write selinux context */
+	xwrite(fd, &block, TAR_BLOCK_SIZE);
+	return TRUE;
+}
+#endif
+
 /* Write out a tar header for the specified file/directory/whatever */
 static int writeTarHeader(struct TarBallInfo *tbInfo,
 		const char *header_name, const char *fileName, struct stat *statbuf)
@@ -468,6 +497,18 @@ static int writeTarHeader(struct TarBallInfo *tbInfo,
 				header_name, S_ISDIR(statbuf->st_mode));
 #endif
 
+#if ENABLE_FEATURE_TAR_SELINUX
+	if (is_selinux_enabled()) {
+		security_context_t sid;
+		lgetfilecon(fileName, &sid);
+		if (sid) {
+			// optional extended block
+			writeSeHeader(tbInfo->tarFd, sid, &header);
+			freecon(sid);
+		}
+	}
+#endif
+
 	/* Now write the header out to disk */
 	chksum_and_xwrite(tbInfo->tarFd, &header);
 
diff --git a/include/bb_archive.h b/include/bb_archive.h
index b82cfd8..d796fcd 100644
--- a/include/bb_archive.h
+++ b/include/bb_archive.h
@@ -146,7 +146,7 @@ typedef struct tar_header_t {     /* byte offset */
 	/* Normally it's defined as magic[6] followed by
 	 * version[2], but we put them together to save code.
 	 */
-	char magic[8];            /* 257-264 */
+	char magic[8];            /* 257-264 (magic 6 + version 2) */
 	char uname[32];           /* 265-296 */
 	char gname[32];           /* 297-328 */
 	char devmajor[8];         /* 329-336 */
-- 
1.7.2.5



_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox

[prev in list] [next in list] [prev in thread] [next in thread]