94 lines
3.4 KiB
Diff
94 lines
3.4 KiB
Diff
From: Aurelien Jarno <aurelien@aurel32.net>
|
||
To: libc-alpha@sourceware.org
|
||
Subject: [PATCH] makedb: fix build with libselinux >= 3.1
|
||
Date: Tue, 21 Jul 2020 07:01:16 +0200
|
||
Message-Id: <20200721050115.204181-1-aurelien@aurel32.net>
|
||
URL: http://patchwork.sourceware.org/project/glibc/patch/20200721050115.204181-1-aurelien@aurel32.net/
|
||
|
||
--------------------------------------------------------------------
|
||
glibc doesn't build with libselinux 3.1 that has been released recently
|
||
due to new deprecations introduced in that version and the fact that
|
||
glibc is built with -Werror by default:
|
||
|
||
| makedb.c: In function ‘set_file_creation_context’:
|
||
| makedb.c:849:3: error: ‘security_context_t’ is deprecated [-Werror=deprecated-declarations]
|
||
| 849 | security_context_t ctx;
|
||
| | ^~~~~~~~~~~~~~~~~~
|
||
| makedb.c:863:3: error: ‘matchpathcon’ is deprecated: Use selabel_lookup instead [-Werror=deprecated-declarations]
|
||
| 863 | if (matchpathcon (outname, S_IFREG | mode, &ctx) == 0 && ctx != NULL)
|
||
| | ^~
|
||
| In file included from makedb.c:50:
|
||
| /usr/include/selinux/selinux.h:500:12: note: declared here
|
||
| 500 | extern int matchpathcon(const char *path,
|
||
| | ^~~~~~~~~~~~
|
||
| cc1: all warnings being treated as errors
|
||
|
||
This patch is an attempt to fix that. It has only built tested, as I do
|
||
not have a system nor the knowledge to test that. I have checked that
|
||
the functions used as replacement are available since at least selinux
|
||
2.0.96, released more than 10 years ago, so we probably do not need any
|
||
version check in the configure script.
|
||
---
|
||
nss/makedb.c | 17 +++++++++++++++--
|
||
1 file changed, 15 insertions(+), 2 deletions(-)
|
||
|
||
I believe this patch is not acceptable for glibc 2.32, I guess we should
|
||
just add a #pragma to ignore -Werror=deprecated-declarations in that
|
||
file.
|
||
|
||
Note: there is the same issue in nscd/selinux.c. I plan to have a look
|
||
once we settle on a strategy.
|
||
|
||
diff --git a/nss/makedb.c b/nss/makedb.c
|
||
index 8e389a16837..a5c4b521172 100644
|
||
--- a/nss/makedb.c
|
||
+++ b/nss/makedb.c
|
||
@@ -47,6 +47,7 @@
|
||
|
||
/* SELinux support. */
|
||
#ifdef HAVE_SELINUX
|
||
+# include <selinux/label.h>
|
||
# include <selinux/selinux.h>
|
||
#endif
|
||
|
||
@@ -846,7 +847,8 @@ set_file_creation_context (const char *outname, mode_t mode)
|
||
{
|
||
static int enabled;
|
||
static int enforcing;
|
||
- security_context_t ctx;
|
||
+ struct selabel_handle *label_hnd = NULL;
|
||
+ char* ctx;
|
||
|
||
/* Check if SELinux is enabled, and remember. */
|
||
if (enabled == 0)
|
||
@@ -858,9 +860,16 @@ set_file_creation_context (const char *outname, mode_t mode)
|
||
if (enforcing == 0)
|
||
enforcing = security_getenforce () ? 1 : -1;
|
||
|
||
+ /* Open the file contexts backend. */
|
||
+ label_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
|
||
+ if (!label_hnd)
|
||
+ if (setfscreatecon (ctx) != 0)
|
||
+ error (enforcing > 0 ? EXIT_FAILURE : 0, 0,
|
||
+ gettext ("cannot initialize SELinux context"));
|
||
+
|
||
/* Determine the context which the file should have. */
|
||
ctx = NULL;
|
||
- if (matchpathcon (outname, S_IFREG | mode, &ctx) == 0 && ctx != NULL)
|
||
+ if (selabel_lookup(label_hnd, &ctx, outname, S_IFREG | mode) == 0 && ctx != NULL)
|
||
{
|
||
if (setfscreatecon (ctx) != 0)
|
||
error (enforcing > 0 ? EXIT_FAILURE : 0, 0,
|
||
@@ -868,7 +877,11 @@ set_file_creation_context (const char *outname, mode_t mode)
|
||
outname);
|
||
|
||
freecon (ctx);
|
||
+ selabel_close(label_hnd);
|
||
}
|
||
+
|
||
+ /* Close the file contexts backend. */
|
||
+ selabel_close(label_hnd);
|
||
}
|
||
|
||
static void
|