emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

ps: use attr/current as fallback for context

Browse Source 
If SELINUX is enabled but the machine is using another MAC system
(like apparmor), ps will fallback to just parsing
"/proc/%d/attr/current", otherwise the label/context would not
be properly displayed in that case.

References:
 https://bugs.debian.org/786956

Signed-off-by: Craig Small <csmall@enc.com.au>
This commit is contained in:
Laurent Bigonville 2016-01-03 18:11:51 +11:00 committed by Craig Small
parent 8639a97250
commit 828540578c
2 changed files with 36 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -2,6 +2,7 @@ procps-ng-NEXT
----------------
* ps: sort by cgroup Debian #692279
* ps: display control group name with -o cgname
* ps: Fallback to attr/current for context Debian #786956
procps-ng-3.3.11
----------------

69
ps/output.c
View File

@ -1212,64 +1212,68 @@ setREL1(LXCNAME)
/****************** FLASK & seLinux security stuff **********************/
// move the bulk of this to libproc sometime
#if !ENABLE_LIBSELINUX
static int pr_context(char *restrict const outbuf, const proc_t *restrict const pp){
char filename[48];
size_t len;
ssize_t num_read;
int fd;
setREL1(ID_TGID)
snprintf(filename, sizeof filename, "/proc/%d/attr/current", rSv(ID_TGID, s_int, pp));
fd = open(filename, O_RDONLY, 0);
if(likely(fd==-1)) goto fail;
num_read = read(fd, outbuf, 666);
close(fd);
if(unlikely(num_read<=0)) goto fail;
outbuf[num_read] = '\0';
len = 0;
while(outbuf[len]>' ' && outbuf[len]<='~') len++;
outbuf[len] = '\0';
if(len) return len;
fail:
outbuf[0] = '-';
outbuf[1] = '\0';
return 1;
}
#else
// This needs more study, considering:
// 1. the static linking option (maybe disable this in that case)
// 2. the -z and -Z option issue
// 3. width of output
static int pr_context(char *restrict const outbuf, const proc_t *restrict const pp){
static void (*ps_freecon)(char*) = 0;
static int (*ps_getpidcon)(pid_t pid, char **context) = 0;
static int (*ps_is_selinux_enabled)(void) = 0;
static int tried_load = 0;
static int selinux_enabled = 0;
size_t len;
char *context;
setREL1(ID_TGID)
#if ENABLE_LIBSELINUX
if(!ps_getpidcon && !tried_load){
void *handle = dlopen("libselinux.so.1", RTLD_NOW);
if(handle){
ps_freecon = dlsym(handle, "freecon");
if(dlerror())
ps_freecon = 0;
dlerror();
ps_getpidcon = dlsym(handle, "getpidcon");
if(dlerror())
ps_getpidcon = 0;
ps_is_selinux_enabled = dlsym(handle, "is_selinux_enabled");
if(dlerror())
ps_is_selinux_enabled = 0;
else
selinux_enabled = ps_is_selinux_enabled();
}
tried_load++;
}
if(ps_getpidcon && !ps_getpidcon(rSv(ID_TGID, s_int, pp), &context)){
#endif
if(ps_getpidcon && selinux_enabled && !ps_getpidcon(rSv(ID_TGID, s_int, pp), &context)){
size_t max_len = OUTBUF_SIZE-1;
len = strlen(context);
if(len > max_len) len = max_len;
memcpy(outbuf, context, len);
if (outbuf[len-1] == '\n') --len;
outbuf[len] = '\0';
free(context);
ps_freecon(context);
}else{
char filename[48];
ssize_t num_read;
int fd;
snprintf(filename, sizeof filename, "/proc/%d/attr/current", rSv(ID_TGID, s_int, pp));
if ((fd = open(filename, O_RDONLY, 0)) != -1) {
num_read = read(fd, outbuf, OUTBUF_SIZE-1);
close(fd);
if (num_read > 0) {
outbuf[num_read] = '\0';
len = 0;
while(isprint(outbuf[len]))
len++;
outbuf[len] = '\0';
if(len)
return len;
}
}
outbuf[0] = '-';
outbuf[1] = '\0';
len = 1;
@ -1277,9 +1281,6 @@ setREL1(ID_TGID)
return len;
}
#endif
////////////////////////////// Test code /////////////////////////////////
// like "args"