Annotation of /trunk/mkinitrd-magellan/busybox/selinux/setfiles.c
Parent Directory | Revision Log
Revision 984 -
(hide annotations)
(download)
Sun May 30 11:32:42 2010 UTC (14 years ago) by niro
File MIME type: text/plain
File size: 15808 byte(s)
Sun May 30 11:32:42 2010 UTC (14 years ago) by niro
File MIME type: text/plain
File size: 15808 byte(s)
-updated to busybox-1.16.1 and enabled blkid/uuid support in default config
1 | niro | 816 | /* |
2 | setfiles: based on policycoreutils 2.0.19 | ||
3 | policycoreutils was released under GPL 2. | ||
4 | Port to BusyBox (c) 2007 by Yuichi Nakamura <ynakam@hitachisoft.jp> | ||
5 | */ | ||
6 | |||
7 | #include "libbb.h" | ||
8 | #if ENABLE_FEATURE_SETFILES_CHECK_OPTION | ||
9 | #include <sepol/sepol.h> | ||
10 | #endif | ||
11 | |||
12 | #define MAX_EXCLUDES 50 | ||
13 | |||
14 | struct edir { | ||
15 | char *directory; | ||
16 | size_t size; | ||
17 | }; | ||
18 | |||
19 | struct globals { | ||
20 | FILE *outfile; | ||
21 | char *policyfile; | ||
22 | char *rootpath; | ||
23 | int rootpathlen; | ||
24 | unsigned count; | ||
25 | int excludeCtr; | ||
26 | int errors; | ||
27 | int verbose; /* getopt32 uses it, has to be int */ | ||
28 | smallint recurse; /* Recursive descent */ | ||
29 | smallint follow_mounts; | ||
30 | /* Behavior flags determined based on setfiles vs. restorecon */ | ||
31 | smallint expand_realpath; /* Expand paths via realpath */ | ||
32 | smallint abort_on_error; /* Abort the file tree walk upon an error */ | ||
33 | int add_assoc; /* Track inode associations for conflict detection */ | ||
34 | int matchpathcon_flags; /* Flags to matchpathcon */ | ||
35 | dev_t dev_id; /* Device id where target file exists */ | ||
36 | int nerr; | ||
37 | struct edir excludeArray[MAX_EXCLUDES]; | ||
38 | }; | ||
39 | |||
40 | #define G (*(struct globals*)&bb_common_bufsiz1) | ||
41 | void BUG_setfiles_globals_too_big(void); | ||
42 | #define INIT_G() do { \ | ||
43 | if (sizeof(G) > COMMON_BUFSIZE) \ | ||
44 | BUG_setfiles_globals_too_big(); \ | ||
45 | /* memset(&G, 0, sizeof(G)); - already is */ \ | ||
46 | } while (0) | ||
47 | #define outfile (G.outfile ) | ||
48 | #define policyfile (G.policyfile ) | ||
49 | #define rootpath (G.rootpath ) | ||
50 | #define rootpathlen (G.rootpathlen ) | ||
51 | #define count (G.count ) | ||
52 | #define excludeCtr (G.excludeCtr ) | ||
53 | #define errors (G.errors ) | ||
54 | #define verbose (G.verbose ) | ||
55 | #define recurse (G.recurse ) | ||
56 | #define follow_mounts (G.follow_mounts ) | ||
57 | #define expand_realpath (G.expand_realpath ) | ||
58 | #define abort_on_error (G.abort_on_error ) | ||
59 | #define add_assoc (G.add_assoc ) | ||
60 | #define matchpathcon_flags (G.matchpathcon_flags) | ||
61 | #define dev_id (G.dev_id ) | ||
62 | #define nerr (G.nerr ) | ||
63 | #define excludeArray (G.excludeArray ) | ||
64 | |||
65 | /* Must match getopt32 string! */ | ||
66 | enum { | ||
67 | OPT_d = (1 << 0), | ||
68 | OPT_e = (1 << 1), | ||
69 | OPT_f = (1 << 2), | ||
70 | OPT_i = (1 << 3), | ||
71 | OPT_l = (1 << 4), | ||
72 | OPT_n = (1 << 5), | ||
73 | OPT_p = (1 << 6), | ||
74 | OPT_q = (1 << 7), | ||
75 | OPT_r = (1 << 8), | ||
76 | OPT_s = (1 << 9), | ||
77 | OPT_v = (1 << 10), | ||
78 | OPT_o = (1 << 11), | ||
79 | OPT_F = (1 << 12), | ||
80 | OPT_W = (1 << 13), | ||
81 | OPT_c = (1 << 14), /* c only for setfiles */ | ||
82 | OPT_R = (1 << 14), /* R only for restorecon */ | ||
83 | }; | ||
84 | #define FLAG_d_debug (option_mask32 & OPT_d) | ||
85 | #define FLAG_e (option_mask32 & OPT_e) | ||
86 | #define FLAG_f (option_mask32 & OPT_f) | ||
87 | #define FLAG_i_ignore_enoent (option_mask32 & OPT_i) | ||
88 | #define FLAG_l_take_log (option_mask32 & OPT_l) | ||
89 | #define FLAG_n_dry_run (option_mask32 & OPT_n) | ||
90 | #define FLAG_p_progress (option_mask32 & OPT_p) | ||
91 | #define FLAG_q_quiet (option_mask32 & OPT_q) | ||
92 | #define FLAG_r (option_mask32 & OPT_r) | ||
93 | #define FLAG_s (option_mask32 & OPT_s) | ||
94 | #define FLAG_v (option_mask32 & OPT_v) | ||
95 | #define FLAG_o (option_mask32 & OPT_o) | ||
96 | #define FLAG_F_force (option_mask32 & OPT_F) | ||
97 | #define FLAG_W_warn_no_match (option_mask32 & OPT_W) | ||
98 | #define FLAG_c (option_mask32 & OPT_c) | ||
99 | #define FLAG_R (option_mask32 & OPT_R) | ||
100 | |||
101 | |||
102 | static void qprintf(const char *fmt UNUSED_PARAM, ...) | ||
103 | { | ||
104 | /* quiet, do nothing */ | ||
105 | } | ||
106 | |||
107 | static void inc_err(void) | ||
108 | { | ||
109 | nerr++; | ||
110 | if (nerr > 9 && !FLAG_d_debug) { | ||
111 | bb_error_msg_and_die("exiting after 10 errors"); | ||
112 | } | ||
113 | } | ||
114 | |||
115 | niro | 984 | static void add_exclude(const char *directory) |
116 | niro | 816 | { |
117 | struct stat sb; | ||
118 | size_t len; | ||
119 | |||
120 | if (directory == NULL || directory[0] != '/') { | ||
121 | bb_error_msg_and_die("full path required for exclude: %s", directory); | ||
122 | |||
123 | } | ||
124 | if (lstat(directory, &sb)) { | ||
125 | bb_error_msg("directory \"%s\" not found, ignoring", directory); | ||
126 | return; | ||
127 | } | ||
128 | if ((sb.st_mode & S_IFDIR) == 0) { | ||
129 | bb_error_msg("\"%s\" is not a directory: mode %o, ignoring", | ||
130 | directory, sb.st_mode); | ||
131 | return; | ||
132 | } | ||
133 | if (excludeCtr == MAX_EXCLUDES) { | ||
134 | bb_error_msg_and_die("maximum excludes %d exceeded", MAX_EXCLUDES); | ||
135 | } | ||
136 | |||
137 | len = strlen(directory); | ||
138 | while (len > 1 && directory[len - 1] == '/') { | ||
139 | len--; | ||
140 | } | ||
141 | excludeArray[excludeCtr].directory = xstrndup(directory, len); | ||
142 | excludeArray[excludeCtr++].size = len; | ||
143 | } | ||
144 | |||
145 | static bool exclude(const char *file) | ||
146 | { | ||
147 | int i = 0; | ||
148 | for (i = 0; i < excludeCtr; i++) { | ||
149 | if (strncmp(file, excludeArray[i].directory, | ||
150 | excludeArray[i].size) == 0) { | ||
151 | if (file[excludeArray[i].size] == '\0' | ||
152 | || file[excludeArray[i].size] == '/') { | ||
153 | return 1; | ||
154 | } | ||
155 | } | ||
156 | } | ||
157 | return 0; | ||
158 | } | ||
159 | |||
160 | static int match(const char *name, struct stat *sb, char **con) | ||
161 | { | ||
162 | int ret; | ||
163 | char path[PATH_MAX + 1]; | ||
164 | char *tmp_path = xstrdup(name); | ||
165 | |||
166 | if (excludeCtr > 0 && exclude(name)) { | ||
167 | goto err; | ||
168 | } | ||
169 | ret = lstat(name, sb); | ||
170 | if (ret) { | ||
171 | if (FLAG_i_ignore_enoent && errno == ENOENT) { | ||
172 | free(tmp_path); | ||
173 | return 0; | ||
174 | } | ||
175 | bb_error_msg("stat(%s)", name); | ||
176 | goto err; | ||
177 | } | ||
178 | |||
179 | if (expand_realpath) { | ||
180 | if (S_ISLNK(sb->st_mode)) { | ||
181 | char *p = NULL; | ||
182 | char *file_sep; | ||
183 | |||
184 | size_t len = 0; | ||
185 | |||
186 | if (verbose > 1) | ||
187 | bb_error_msg("warning! %s refers to a symbolic link, not following last component", name); | ||
188 | |||
189 | file_sep = strrchr(tmp_path, '/'); | ||
190 | if (file_sep == tmp_path) { | ||
191 | file_sep++; | ||
192 | path[0] = '\0'; | ||
193 | p = path; | ||
194 | } else if (file_sep) { | ||
195 | *file_sep++ = '\0'; | ||
196 | p = realpath(tmp_path, path); | ||
197 | } else { | ||
198 | file_sep = tmp_path; | ||
199 | p = realpath("./", path); | ||
200 | } | ||
201 | if (p) | ||
202 | len = strlen(p); | ||
203 | if (!p || len + strlen(file_sep) + 2 > PATH_MAX) { | ||
204 | bb_perror_msg("realpath(%s) failed", name); | ||
205 | goto err; | ||
206 | } | ||
207 | p += len; | ||
208 | /* ensure trailing slash of directory name */ | ||
209 | if (len == 0 || p[-1] != '/') { | ||
210 | *p++ = '/'; | ||
211 | } | ||
212 | strcpy(p, file_sep); | ||
213 | name = path; | ||
214 | if (excludeCtr > 0 && exclude(name)) | ||
215 | goto err; | ||
216 | |||
217 | } else { | ||
218 | char *p; | ||
219 | p = realpath(name, path); | ||
220 | if (!p) { | ||
221 | bb_perror_msg("realpath(%s)", name); | ||
222 | goto err; | ||
223 | } | ||
224 | name = p; | ||
225 | if (excludeCtr > 0 && exclude(name)) | ||
226 | goto err; | ||
227 | } | ||
228 | } | ||
229 | |||
230 | /* name will be what is matched in the policy */ | ||
231 | if (NULL != rootpath) { | ||
232 | if (0 != strncmp(rootpath, name, rootpathlen)) { | ||
233 | bb_error_msg("%s is not located in %s", | ||
234 | name, rootpath); | ||
235 | goto err; | ||
236 | } | ||
237 | name += rootpathlen; | ||
238 | } | ||
239 | |||
240 | free(tmp_path); | ||
241 | if (rootpath != NULL && name[0] == '\0') | ||
242 | /* this is actually the root dir of the alt root */ | ||
243 | return matchpathcon_index("/", sb->st_mode, con); | ||
244 | return matchpathcon_index(name, sb->st_mode, con); | ||
245 | err: | ||
246 | free(tmp_path); | ||
247 | return -1; | ||
248 | } | ||
249 | |||
250 | /* Compare two contexts to see if their differences are "significant", | ||
251 | * or whether the only difference is in the user. */ | ||
252 | static bool only_changed_user(const char *a, const char *b) | ||
253 | { | ||
254 | if (FLAG_F_force) | ||
255 | return 0; | ||
256 | if (!a || !b) | ||
257 | return 0; | ||
258 | a = strchr(a, ':'); /* Rest of the context after the user */ | ||
259 | b = strchr(b, ':'); | ||
260 | if (!a || !b) | ||
261 | return 0; | ||
262 | return (strcmp(a, b) == 0); | ||
263 | } | ||
264 | |||
265 | static int restore(const char *file) | ||
266 | { | ||
267 | char *my_file; | ||
268 | struct stat my_sb; | ||
269 | int i, j, ret; | ||
270 | char *context = NULL; | ||
271 | char *newcon = NULL; | ||
272 | bool user_only_changed = 0; | ||
273 | int retval = 0; | ||
274 | |||
275 | my_file = bb_simplify_path(file); | ||
276 | |||
277 | i = match(my_file, &my_sb, &newcon); | ||
278 | |||
279 | if (i < 0) /* No matching specification. */ | ||
280 | goto out; | ||
281 | |||
282 | if (FLAG_p_progress) { | ||
283 | count++; | ||
284 | if (count % 0x400 == 0) { /* every 1024 times */ | ||
285 | count = (count % (80*0x400)); | ||
286 | if (count == 0) | ||
287 | bb_putchar('\n'); | ||
288 | bb_putchar('*'); | ||
289 | niro | 984 | fflush_all(); |
290 | niro | 816 | } |
291 | } | ||
292 | |||
293 | /* | ||
294 | * Try to add an association between this inode and | ||
295 | * this specification. If there is already an association | ||
296 | * for this inode and it conflicts with this specification, | ||
297 | * then use the last matching specification. | ||
298 | */ | ||
299 | if (add_assoc) { | ||
300 | j = matchpathcon_filespec_add(my_sb.st_ino, i, my_file); | ||
301 | if (j < 0) | ||
302 | goto err; | ||
303 | |||
304 | if (j != i) { | ||
305 | /* There was already an association and it took precedence. */ | ||
306 | goto out; | ||
307 | } | ||
308 | } | ||
309 | |||
310 | if (FLAG_d_debug) | ||
311 | printf("%s: %s matched by %s\n", applet_name, my_file, newcon); | ||
312 | |||
313 | /* Get the current context of the file. */ | ||
314 | ret = lgetfilecon_raw(my_file, &context); | ||
315 | if (ret < 0) { | ||
316 | if (errno == ENODATA) { | ||
317 | context = NULL; /* paranoia */ | ||
318 | } else { | ||
319 | bb_perror_msg("lgetfilecon_raw on %s", my_file); | ||
320 | goto err; | ||
321 | } | ||
322 | user_only_changed = 0; | ||
323 | } else | ||
324 | user_only_changed = only_changed_user(context, newcon); | ||
325 | |||
326 | /* | ||
327 | * Do not relabel the file if the matching specification is | ||
328 | * <<none>> or the file is already labeled according to the | ||
329 | * specification. | ||
330 | */ | ||
331 | if ((strcmp(newcon, "<<none>>") == 0) | ||
332 | || (context && (strcmp(context, newcon) == 0) && !FLAG_F_force)) { | ||
333 | goto out; | ||
334 | } | ||
335 | |||
336 | if (!FLAG_F_force && context && (is_context_customizable(context) > 0)) { | ||
337 | if (verbose > 1) { | ||
338 | bb_error_msg("skipping %s. %s is customizable_types", | ||
339 | my_file, context); | ||
340 | } | ||
341 | goto out; | ||
342 | } | ||
343 | |||
344 | if (verbose) { | ||
345 | /* If we're just doing "-v", trim out any relabels where | ||
346 | * the user has changed but the role and type are the | ||
347 | * same. For "-vv", emit everything. */ | ||
348 | if (verbose > 1 || !user_only_changed) { | ||
349 | bb_info_msg("%s: reset %s context %s->%s", | ||
350 | niro | 984 | applet_name, my_file, context ? context : "", newcon); |
351 | niro | 816 | } |
352 | } | ||
353 | |||
354 | if (FLAG_l_take_log && !user_only_changed) { | ||
355 | if (context) | ||
356 | bb_info_msg("relabeling %s from %s to %s", my_file, context, newcon); | ||
357 | else | ||
358 | bb_info_msg("labeling %s to %s", my_file, newcon); | ||
359 | } | ||
360 | |||
361 | if (outfile && !user_only_changed) | ||
362 | fprintf(outfile, "%s\n", my_file); | ||
363 | |||
364 | /* | ||
365 | * Do not relabel the file if -n was used. | ||
366 | */ | ||
367 | if (FLAG_n_dry_run || user_only_changed) | ||
368 | goto out; | ||
369 | |||
370 | /* | ||
371 | * Relabel the file to the specified context. | ||
372 | */ | ||
373 | ret = lsetfilecon(my_file, newcon); | ||
374 | if (ret) { | ||
375 | bb_perror_msg("lsetfileconon(%s,%s)", my_file, newcon); | ||
376 | goto err; | ||
377 | } | ||
378 | |||
379 | out: | ||
380 | freecon(context); | ||
381 | freecon(newcon); | ||
382 | free(my_file); | ||
383 | return retval; | ||
384 | err: | ||
385 | retval--; /* -1 */ | ||
386 | goto out; | ||
387 | } | ||
388 | |||
389 | /* | ||
390 | * Apply the last matching specification to a file. | ||
391 | * This function is called by recursive_action on each file during | ||
392 | * the directory traversal. | ||
393 | */ | ||
394 | static int FAST_FUNC apply_spec( | ||
395 | const char *file, | ||
396 | struct stat *sb, | ||
397 | void *userData UNUSED_PARAM, | ||
398 | int depth UNUSED_PARAM) | ||
399 | { | ||
400 | if (!follow_mounts) { | ||
401 | /* setfiles does not process across different mount points */ | ||
402 | if (sb->st_dev != dev_id) { | ||
403 | return SKIP; | ||
404 | } | ||
405 | } | ||
406 | errors |= restore(file); | ||
407 | if (abort_on_error && errors) | ||
408 | return FALSE; | ||
409 | return TRUE; | ||
410 | } | ||
411 | |||
412 | |||
413 | static int canoncon(const char *path, unsigned lineno, char **contextp) | ||
414 | { | ||
415 | static const char err_msg[] ALIGN1 = "%s: line %u has invalid context %s"; | ||
416 | |||
417 | char *tmpcon; | ||
418 | char *context = *contextp; | ||
419 | int invalid = 0; | ||
420 | |||
421 | #if ENABLE_FEATURE_SETFILES_CHECK_OPTION | ||
422 | if (policyfile) { | ||
423 | if (sepol_check_context(context) >= 0) | ||
424 | return 0; | ||
425 | /* Exit immediately if we're in checking mode. */ | ||
426 | bb_error_msg_and_die(err_msg, path, lineno, context); | ||
427 | } | ||
428 | #endif | ||
429 | |||
430 | if (security_canonicalize_context_raw(context, &tmpcon) < 0) { | ||
431 | if (errno != ENOENT) { | ||
432 | invalid = 1; | ||
433 | inc_err(); | ||
434 | } | ||
435 | } else { | ||
436 | free(context); | ||
437 | *contextp = tmpcon; | ||
438 | } | ||
439 | |||
440 | if (invalid) { | ||
441 | bb_error_msg(err_msg, path, lineno, context); | ||
442 | } | ||
443 | |||
444 | return invalid; | ||
445 | } | ||
446 | |||
447 | static int process_one(char *name) | ||
448 | { | ||
449 | struct stat sb; | ||
450 | int rc; | ||
451 | |||
452 | rc = lstat(name, &sb); | ||
453 | if (rc < 0) { | ||
454 | if (FLAG_i_ignore_enoent && errno == ENOENT) | ||
455 | return 0; | ||
456 | bb_perror_msg("stat(%s)", name); | ||
457 | goto err; | ||
458 | } | ||
459 | dev_id = sb.st_dev; | ||
460 | |||
461 | if (S_ISDIR(sb.st_mode) && recurse) { | ||
462 | if (recursive_action(name, | ||
463 | ACTION_RECURSE, | ||
464 | apply_spec, | ||
465 | apply_spec, | ||
466 | NULL, 0) != TRUE) { | ||
467 | bb_error_msg("error while labeling %s", name); | ||
468 | goto err; | ||
469 | } | ||
470 | } else { | ||
471 | rc = restore(name); | ||
472 | if (rc) | ||
473 | goto err; | ||
474 | } | ||
475 | |||
476 | out: | ||
477 | if (add_assoc) { | ||
478 | if (FLAG_q_quiet) | ||
479 | set_matchpathcon_printf(&qprintf); | ||
480 | matchpathcon_filespec_eval(); | ||
481 | set_matchpathcon_printf(NULL); | ||
482 | matchpathcon_filespec_destroy(); | ||
483 | } | ||
484 | |||
485 | return rc; | ||
486 | |||
487 | err: | ||
488 | rc = -1; | ||
489 | goto out; | ||
490 | } | ||
491 | |||
492 | int setfiles_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; | ||
493 | niro | 984 | int setfiles_main(int argc UNUSED_PARAM, char **argv) |
494 | niro | 816 | { |
495 | struct stat sb; | ||
496 | int rc, i = 0; | ||
497 | const char *input_filename = NULL; | ||
498 | char *buf = NULL; | ||
499 | size_t buf_len; | ||
500 | int flags; | ||
501 | llist_t *exclude_dir = NULL; | ||
502 | char *out_filename = NULL; | ||
503 | |||
504 | INIT_G(); | ||
505 | |||
506 | if (applet_name[0] == 's') { /* "setfiles" */ | ||
507 | /* | ||
508 | * setfiles: | ||
509 | * Recursive descent, | ||
510 | * Does not expand paths via realpath, | ||
511 | * Aborts on errors during the file tree walk, | ||
512 | * Try to track inode associations for conflict detection, | ||
513 | * Does not follow mounts, | ||
514 | * Validates all file contexts at init time. | ||
515 | */ | ||
516 | recurse = 1; | ||
517 | abort_on_error = 1; | ||
518 | add_assoc = 1; | ||
519 | /* follow_mounts = 0; - already is */ | ||
520 | matchpathcon_flags = MATCHPATHCON_VALIDATE | MATCHPATHCON_NOTRANS; | ||
521 | } else { | ||
522 | /* | ||
523 | * restorecon: | ||
524 | * No recursive descent unless -r/-R, | ||
525 | * Expands paths via realpath, | ||
526 | * Do not abort on errors during the file tree walk, | ||
527 | * Do not try to track inode associations for conflict detection, | ||
528 | * Follows mounts, | ||
529 | * Does lazy validation of contexts upon use. | ||
530 | */ | ||
531 | expand_realpath = 1; | ||
532 | follow_mounts = 1; | ||
533 | matchpathcon_flags = MATCHPATHCON_NOTRANS; | ||
534 | /* restorecon only */ | ||
535 | selinux_or_die(); | ||
536 | } | ||
537 | |||
538 | set_matchpathcon_flags(matchpathcon_flags); | ||
539 | |||
540 | opt_complementary = "e::vv:v--p:p--v:v--q:q--v"; | ||
541 | /* Option order must match OPT_x definitions! */ | ||
542 | if (applet_name[0] == 'r') { /* restorecon */ | ||
543 | flags = getopt32(argv, "de:f:ilnpqrsvo:FWR", | ||
544 | &exclude_dir, &input_filename, &out_filename, &verbose); | ||
545 | } else { /* setfiles */ | ||
546 | flags = getopt32(argv, "de:f:ilnpqr:svo:FW" | ||
547 | niro | 984 | IF_FEATURE_SETFILES_CHECK_OPTION("c:"), |
548 | niro | 816 | &exclude_dir, &input_filename, &rootpath, &out_filename, |
549 | niro | 984 | IF_FEATURE_SETFILES_CHECK_OPTION(&policyfile,) |
550 | niro | 816 | &verbose); |
551 | } | ||
552 | niro | 984 | argv += optind; |
553 | niro | 816 | |
554 | #if ENABLE_FEATURE_SETFILES_CHECK_OPTION | ||
555 | if ((applet_name[0] == 's') && (flags & OPT_c)) { | ||
556 | FILE *policystream; | ||
557 | |||
558 | policystream = xfopen_for_read(policyfile); | ||
559 | if (sepol_set_policydb_from_file(policystream) < 0) { | ||
560 | bb_error_msg_and_die("sepol_set_policydb_from_file on %s", policyfile); | ||
561 | } | ||
562 | fclose(policystream); | ||
563 | |||
564 | /* Only process the specified file_contexts file, not | ||
565 | any .homedirs or .local files, and do not perform | ||
566 | context translations. */ | ||
567 | set_matchpathcon_flags(MATCHPATHCON_BASEONLY | | ||
568 | MATCHPATHCON_NOTRANS | | ||
569 | MATCHPATHCON_VALIDATE); | ||
570 | } | ||
571 | #endif | ||
572 | |||
573 | while (exclude_dir) | ||
574 | add_exclude(llist_pop(&exclude_dir)); | ||
575 | |||
576 | if (flags & OPT_o) { | ||
577 | outfile = stdout; | ||
578 | if (NOT_LONE_CHAR(out_filename, '-')) { | ||
579 | outfile = xfopen_for_write(out_filename); | ||
580 | } | ||
581 | } | ||
582 | if (applet_name[0] == 'r') { /* restorecon */ | ||
583 | if (flags & (OPT_r | OPT_R)) | ||
584 | recurse = 1; | ||
585 | } else { /* setfiles */ | ||
586 | if (flags & OPT_r) | ||
587 | rootpathlen = strlen(rootpath); | ||
588 | } | ||
589 | if (flags & OPT_s) { | ||
590 | input_filename = "-"; | ||
591 | add_assoc = 0; | ||
592 | } | ||
593 | |||
594 | if (applet_name[0] == 's') { /* setfiles */ | ||
595 | /* Use our own invalid context checking function so that | ||
596 | we can support either checking against the active policy or | ||
597 | checking against a binary policy file. */ | ||
598 | set_matchpathcon_canoncon(&canoncon); | ||
599 | niro | 984 | if (!argv[0]) |
600 | niro | 816 | bb_show_usage(); |
601 | niro | 984 | xstat(argv[0], &sb); |
602 | niro | 816 | if (!S_ISREG(sb.st_mode)) { |
603 | niro | 984 | bb_error_msg_and_die("spec file %s is not a regular file", argv[0]); |
604 | niro | 816 | } |
605 | /* Load the file contexts configuration and check it. */ | ||
606 | niro | 984 | rc = matchpathcon_init(argv[0]); |
607 | niro | 816 | if (rc < 0) { |
608 | niro | 984 | bb_simple_perror_msg_and_die(argv[0]); |
609 | niro | 816 | } |
610 | if (nerr) | ||
611 | exit(EXIT_FAILURE); | ||
612 | niro | 984 | argv++; |
613 | niro | 816 | } |
614 | |||
615 | if (input_filename) { | ||
616 | ssize_t len; | ||
617 | FILE *f = stdin; | ||
618 | |||
619 | if (NOT_LONE_CHAR(input_filename, '-')) | ||
620 | f = xfopen_for_read(input_filename); | ||
621 | while ((len = getline(&buf, &buf_len, f)) > 0) { | ||
622 | buf[len - 1] = '\0'; | ||
623 | errors |= process_one(buf); | ||
624 | } | ||
625 | if (ENABLE_FEATURE_CLEAN_UP) | ||
626 | fclose_if_not_stdin(f); | ||
627 | } else { | ||
628 | niro | 984 | if (!argv[0]) |
629 | niro | 816 | bb_show_usage(); |
630 | niro | 984 | for (i = 0; argv[i]; i++) { |
631 | niro | 816 | errors |= process_one(argv[i]); |
632 | } | ||
633 | } | ||
634 | |||
635 | if (FLAG_W_warn_no_match) | ||
636 | matchpathcon_checkmatches(argv[0]); | ||
637 | |||
638 | if (ENABLE_FEATURE_CLEAN_UP && outfile) | ||
639 | fclose(outfile); | ||
640 | |||
641 | return errors; | ||
642 | } |