busybox/selinux/chcon.c

/*
 * chcon -- change security context, based on coreutils-5.97-13
 *
 * Port to busybox: KaiGai Kohei <kaigai@kaigai.gr.jp>
 *
 * Copyright (C) 2006 - 2007 KaiGai Kohei <kaigai@kaigai.gr.jp>
 */
#include <getopt.h>
#include <selinux/context.h>

#include "libbb.h"

#define OPT_RECURSIVE		(1<<0)	/* 'R' */
#define OPT_CHANHES		(1<<1)	/* 'c' */
#define OPT_NODEREFERENCE	(1<<2)	/* 'h' */
#define OPT_QUIET		(1<<3)	/* 'f' */
#define OPT_USER		(1<<4)	/* 'u' */
#define OPT_ROLE		(1<<5)	/* 'r' */
#define OPT_TYPE		(1<<6)	/* 't' */
#define OPT_RANGE		(1<<7)	/* 'l' */
#define OPT_VERBOSE		(1<<8)	/* 'v' */
#define OPT_REFERENCE		((1<<9) * ENABLE_FEATURE_CHCON_LONG_OPTIONS)
#define OPT_COMPONENT_SPECIFIED	(OPT_USER | OPT_ROLE | OPT_TYPE | OPT_RANGE)

static char *user = NULL;
static char *role = NULL;
static char *type = NULL;
static char *range = NULL;
static char *specified_context = NULL;

static int FAST_FUNC change_filedir_context(
		const char *fname,
		struct stat *stbuf UNUSED_PARAM,
		void *userData UNUSED_PARAM,
		int depth UNUSED_PARAM)
{
	context_t context = NULL;
	security_context_t file_context = NULL;
	security_context_t context_string;
	int rc = FALSE;
	int status = 0;

	if (option_mask32 & OPT_NODEREFERENCE) {
		status = lgetfilecon(fname, &file_context);
	} else {
		status = getfilecon(fname, &file_context);
	}
	if (status < 0 && errno != ENODATA) {
		if ((option_mask32 & OPT_QUIET) == 0)
			bb_error_msg("cannot obtain security context: %s", fname);
		goto skip;
	}

	if (file_context == NULL && specified_context == NULL) {
		bb_error_msg("cannot apply partial context to unlabeled file %s", fname);
		goto skip;
	}

	if (specified_context == NULL) {
		context = set_security_context_component(file_context,
							 user, role, type, range);
		if (!context) {
			bb_error_msg("cannot compute security context from %s", file_context);
			goto skip;
		}
	} else {
		context = context_new(specified_context);
		if (!context) {
			bb_error_msg("invalid context: %s", specified_context);
			goto skip;
		}
	}

	context_string = context_str(context);
	if (!context_string) {
		bb_error_msg("cannot obtain security context in text expression");
		goto skip;
	}

	if (file_context == NULL || strcmp(context_string, file_context) != 0) {
		int fail;

		if (option_mask32 & OPT_NODEREFERENCE) {
			fail = lsetfilecon(fname, context_string);
		} else {
			fail = setfilecon(fname, context_string);
		}
		if ((option_mask32 & OPT_VERBOSE) || ((option_mask32 & OPT_CHANHES) && !fail)) {
			printf(!fail
			       ? "context of %s changed to %s\n"
			       : "failed to change context of %s to %s\n",
			       fname, context_string);
		}
		if (!fail) {
			rc = TRUE;
		} else if ((option_mask32 & OPT_QUIET) == 0) {
			bb_error_msg("failed to change context of %s to %s",
				     fname, context_string);
		}
	} else if (option_mask32 & OPT_VERBOSE) {
		printf("context of %s retained as %s\n", fname, context_string);
		rc = TRUE;
	}
skip:
	context_free(context);
	freecon(file_context);

	return rc;
}

#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
static const char chcon_longopts[] ALIGN1 =
	"recursive\0"      No_argument       "R"
	"changes\0"        No_argument       "c"
	"no-dereference\0" No_argument       "h"
	"silent\0"         No_argument       "f"
	"quiet\0"          No_argument       "f"
	"user\0"           Required_argument "u"
	"role\0"           Required_argument "r"
	"type\0"           Required_argument "t"
	"range\0"          Required_argument "l"
	"verbose\0"        No_argument       "v"
	"reference\0"      Required_argument "\xff" /* no short option */
	;
#endif

int chcon_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
int chcon_main(int argc UNUSED_PARAM, char **argv)
{
	char *reference_file;
	char *fname;
	int i, errors = 0;

#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
	applet_long_options = chcon_longopts;
#endif
	opt_complementary = "-1"  /* at least 1 param */
		":?"  /* error if exclusivity constraints are violated */
#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
		":\xff--urtl:u--\xff:r--\xff:t--\xff:l--\xff"
#endif
		":f--v:v--f";  /* 'verbose' and 'quiet' are exclusive */
	getopt32(argv, "Rchfu:r:t:l:v",
		&user, &role, &type, &range, &reference_file);
	argv += optind;

#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
	if (option_mask32 & OPT_REFERENCE) {
		/* FIXME: lgetfilecon() should be used when '-h' is specified.
		   But current implementation follows the original one. */
		if (getfilecon(reference_file, &specified_context) < 0)
			bb_perror_msg_and_die("getfilecon('%s') failed", reference_file);
	} else
#endif
	if ((option_mask32 & OPT_COMPONENT_SPECIFIED) == 0) {
		specified_context = *argv++;
		/* specified_context is never NULL -
		 * "-1" in opt_complementary prevents this. */
		if (!argv[0])
			bb_error_msg_and_die("too few arguments");
	}

	for (i = 0; (fname = argv[i]) != NULL; i++) {
		int fname_len = strlen(fname);
		while (fname_len > 1 && fname[fname_len - 1] == '/')
			fname_len--;
		fname[fname_len] = '\0';

		if (recursive_action(fname,
				     1<<option_mask32 & OPT_RECURSIVE,
				     change_filedir_context,
				     change_filedir_context,
				     NULL, 0) != TRUE)
			errors = 1;
	}
	return errors;
}
1	niro	816	/*
2			* chcon -- change security context, based on coreutils-5.97-13
3			*
4			* Port to busybox: KaiGai Kohei <kaigai@kaigai.gr.jp>
5			*
6			* Copyright (C) 2006 - 2007 KaiGai Kohei <kaigai@kaigai.gr.jp>
7			*/
8			#include <getopt.h>
9			#include <selinux/context.h>
10
11			#include "libbb.h"
12
13			#define OPT_RECURSIVE (1<<0) /* 'R' */
14			#define OPT_CHANHES (1<<1) /* 'c' */
15			#define OPT_NODEREFERENCE (1<<2) /* 'h' */
16			#define OPT_QUIET (1<<3) /* 'f' */
17			#define OPT_USER (1<<4) /* 'u' */
18			#define OPT_ROLE (1<<5) /* 'r' */
19			#define OPT_TYPE (1<<6) /* 't' */
20			#define OPT_RANGE (1<<7) /* 'l' */
21			#define OPT_VERBOSE (1<<8) /* 'v' */
22			#define OPT_REFERENCE ((1<<9) * ENABLE_FEATURE_CHCON_LONG_OPTIONS)
23			#define OPT_COMPONENT_SPECIFIED (OPT_USER \| OPT_ROLE \| OPT_TYPE \| OPT_RANGE)
24
25			static char *user = NULL;
26			static char *role = NULL;
27			static char *type = NULL;
28			static char *range = NULL;
29			static char *specified_context = NULL;
30
31			static int FAST_FUNC change_filedir_context(
32			const char *fname,
33			struct stat *stbuf UNUSED_PARAM,
34			void *userData UNUSED_PARAM,
35			int depth UNUSED_PARAM)
36			{
37			context_t context = NULL;
38			security_context_t file_context = NULL;
39			security_context_t context_string;
40			int rc = FALSE;
41			int status = 0;
42
43			if (option_mask32 & OPT_NODEREFERENCE) {
44			status = lgetfilecon(fname, &file_context);
45			} else {
46			status = getfilecon(fname, &file_context);
47			}
48			if (status < 0 && errno != ENODATA) {
49			if ((option_mask32 & OPT_QUIET) == 0)
50			bb_error_msg("cannot obtain security context: %s", fname);
51			goto skip;
52			}
53
54			if (file_context == NULL && specified_context == NULL) {
55			bb_error_msg("cannot apply partial context to unlabeled file %s", fname);
56			goto skip;
57			}
58
59			if (specified_context == NULL) {
60			context = set_security_context_component(file_context,
61			user, role, type, range);
62			if (!context) {
63			bb_error_msg("cannot compute security context from %s", file_context);
64			goto skip;
65			}
66			} else {
67			context = context_new(specified_context);
68			if (!context) {
69			bb_error_msg("invalid context: %s", specified_context);
70			goto skip;
71			}
72			}
73
74			context_string = context_str(context);
75			if (!context_string) {
76			bb_error_msg("cannot obtain security context in text expression");
77			goto skip;
78			}
79
80			if (file_context == NULL \|\| strcmp(context_string, file_context) != 0) {
81			int fail;
82
83			if (option_mask32 & OPT_NODEREFERENCE) {
84			fail = lsetfilecon(fname, context_string);
85			} else {
86			fail = setfilecon(fname, context_string);
87			}
88			if ((option_mask32 & OPT_VERBOSE) \|\| ((option_mask32 & OPT_CHANHES) && !fail)) {
89			printf(!fail
90			? "context of %s changed to %s\n"
91			: "failed to change context of %s to %s\n",
92			fname, context_string);
93			}
94			if (!fail) {
95			rc = TRUE;
96			} else if ((option_mask32 & OPT_QUIET) == 0) {
97			bb_error_msg("failed to change context of %s to %s",
98			fname, context_string);
99			}
100			} else if (option_mask32 & OPT_VERBOSE) {
101			printf("context of %s retained as %s\n", fname, context_string);
102			rc = TRUE;
103			}
104			skip:
105			context_free(context);
106			freecon(file_context);
107
108			return rc;
109			}
110
111			#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
112			static const char chcon_longopts[] ALIGN1 =
113			"recursive\0" No_argument "R"
114			"changes\0" No_argument "c"
115			"no-dereference\0" No_argument "h"
116			"silent\0" No_argument "f"
117			"quiet\0" No_argument "f"
118			"user\0" Required_argument "u"
119			"role\0" Required_argument "r"
120			"type\0" Required_argument "t"
121			"range\0" Required_argument "l"
122			"verbose\0" No_argument "v"
123			"reference\0" Required_argument "\xff" /* no short option */
124			;
125			#endif
126
127			int chcon_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
128			int chcon_main(int argc UNUSED_PARAM, char **argv)
129			{
130			char *reference_file;
131			char *fname;
132			int i, errors = 0;
133
134			#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
135			applet_long_options = chcon_longopts;
136			#endif
137			opt_complementary = "-1" /* at least 1 param */
138			":?" /* error if exclusivity constraints are violated */
139			#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
140			":\xff--urtl:u--\xff:r--\xff:t--\xff:l--\xff"
141			#endif
142			":f--v:v--f"; /* 'verbose' and 'quiet' are exclusive */
143			getopt32(argv, "Rchfu:r:t:l:v",
144			&user, &role, &type, &range, &reference_file);
145			argv += optind;
146
147			#if ENABLE_FEATURE_CHCON_LONG_OPTIONS
148			if (option_mask32 & OPT_REFERENCE) {
149			/* FIXME: lgetfilecon() should be used when '-h' is specified.
150			But current implementation follows the original one. */
151			if (getfilecon(reference_file, &specified_context) < 0)
152			bb_perror_msg_and_die("getfilecon('%s') failed", reference_file);
153			} else
154			#endif
155			if ((option_mask32 & OPT_COMPONENT_SPECIFIED) == 0) {
156			specified_context = *argv++;
157			/* specified_context is never NULL -
158			* "-1" in opt_complementary prevents this. */
159			if (!argv[0])
160			bb_error_msg_and_die("too few arguments");
161			}
162
163			for (i = 0; (fname = argv[i]) != NULL; i++) {
164			int fname_len = strlen(fname);
165			while (fname_len > 1 && fname[fname_len - 1] == '/')
166			fname_len--;
167			fname[fname_len] = '\0';
168
169			if (recursive_action(fname,
170			1<<option_mask32 & OPT_RECURSIVE,
171			change_filedir_context,
172			change_filedir_context,
173			NULL, 0) != TRUE)
174			errors = 1;
175			}
176			return errors;
177			}