NSA SELinux for Linux 2.6.xx
This commit is contained in:
parent
e6bf84b8f3
commit
c36c11c6b2
8
NEWS
8
NEWS
@ -1,11 +1,11 @@
|
|||||||
procps-3.1.14 --> procps-3.1.15
|
procps-3.1.14 --> procps-3.1.15
|
||||||
|
|
||||||
install to /lib64 if it exists
|
install to /lib64 if it exists
|
||||||
hide kernel PID bug (Linux 2.4.13-pre1 to 2.4.MAX) #217278 #219730 #217525
|
hide kernel PID bug (Linux 2.4.13-pre1 to 2.4.MAX) #217278 #219730 #217525 #224470
|
||||||
ps: faster threaded display
|
ps: faster threaded display
|
||||||
...top: Jim's fix
|
top: auto-margin problem #217559
|
||||||
...top: newline fix
|
ps: support NSA SELinux, all builds, Linux 2.6+ #193648
|
||||||
...sysctl: man page tweak
|
sysctl: tweak man page for ESR's broken parser
|
||||||
|
|
||||||
procps-3.1.13 --> procps-3.1.14
|
procps-3.1.13 --> procps-3.1.14
|
||||||
|
|
||||||
|
@ -27,10 +27,6 @@
|
|||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#include <sys/stat.h>
|
#include <sys/stat.h>
|
||||||
|
|
||||||
#ifdef FLASK_LINUX
|
|
||||||
#include <fs_secure.h>
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// sometimes it's easier to do this manually, w/o gcc helping
|
// sometimes it's easier to do this manually, w/o gcc helping
|
||||||
#ifdef PROF
|
#ifdef PROF
|
||||||
extern void __cyg_profile_func_enter(void*,void*);
|
extern void __cyg_profile_func_enter(void*,void*);
|
||||||
|
@ -139,7 +139,6 @@
|
|||||||
#define FF_LX 0x0100 /* X */
|
#define FF_LX 0x0100 /* X */
|
||||||
#define FF_Lm 0x0200 /* m */ /* overloaded: threads, sort, format */
|
#define FF_Lm 0x0200 /* m */ /* overloaded: threads, sort, format */
|
||||||
#define FF_Fc 0x0400 /* --context */ /* Flask security context format */
|
#define FF_Fc 0x0400 /* --context */ /* Flask security context format */
|
||||||
#define FF_Fs 0x0800 /* --SID */ /* Flask SID format */
|
|
||||||
|
|
||||||
/* predefined format modifier flags such as: -l -f l u s -j */
|
/* predefined format modifier flags such as: -l -f l u s -j */
|
||||||
#define FM_c 0x0001 /* -c */
|
#define FM_c 0x0001 /* -c */
|
||||||
|
11
ps/help.c
11
ps/help.c
@ -34,14 +34,11 @@ const char *help_message =
|
|||||||
"-j,j job control s signal --group --user --sid --rows\n"
|
"-j,j job control s signal --group --user --sid --rows\n"
|
||||||
"-O,O preloaded -o v virtual memory --cumulative --format --deselect\n"
|
"-O,O preloaded -o v virtual memory --cumulative --format --deselect\n"
|
||||||
"-l,l long u user-oriented --sort --tty --forest --version\n"
|
"-l,l long u user-oriented --sort --tty --forest --version\n"
|
||||||
"-F extra full X registers --heading --no-heading\n"
|
"-F extra full X registers --heading --no-heading --context\n"
|
||||||
#ifdef FLASK_LINUX
|
|
||||||
" --context --SID (Flask only)\n"
|
|
||||||
#endif
|
|
||||||
" ********* misc options *********\n"
|
" ********* misc options *********\n"
|
||||||
"-V,V show version L list format codes f ASCII art forest\n"
|
"-V,V show version L list format codes f ASCII art forest\n"
|
||||||
"-m,m show threads S children in sum -y change -l format\n"
|
"-m,m,-L,-T,H threads S children in sum -y change -l format\n"
|
||||||
"-n,N set namelist file c true command name n numeric WCHAN,UID\n"
|
"-c scheduling class c true command name n numeric WCHAN,UID\n"
|
||||||
"-w,w wide output e show environment -H process hierarchy\n"
|
"-w,w wide output e show environment -H process hierarchy\n"
|
||||||
;
|
;
|
||||||
|
|
||||||
@ -49,6 +46,6 @@ const char *help_message =
|
|||||||
|
|
||||||
/* Missing:
|
/* Missing:
|
||||||
*
|
*
|
||||||
* -c -L -P -M --info
|
* -P -M --info
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
168
ps/output.c
168
ps/output.c
@ -65,14 +65,6 @@
|
|||||||
#include "../proc/escape.h"
|
#include "../proc/escape.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|
||||||
#ifdef FLASK_LINUX
|
|
||||||
#include <errno.h>
|
|
||||||
#include <fs_secure.h>
|
|
||||||
#include <ss.h>
|
|
||||||
#define DEF_CTXTLEN 255
|
|
||||||
#endif
|
|
||||||
|
|
||||||
|
|
||||||
/* TODO:
|
/* TODO:
|
||||||
* Stop assuming system time is local time.
|
* Stop assuming system time is local time.
|
||||||
*/
|
*/
|
||||||
@ -941,142 +933,38 @@ static int pr_sgi_p(char *restrict const outbuf, const proc_t *restrict const pp
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/****************** FLASK security stuff **********************/
|
/****************** FLASK & seLinux security stuff **********************/
|
||||||
#ifdef FLASK_LINUX
|
|
||||||
|
|
||||||
/*
|
|
||||||
* The sr_fn() calls -- for sorting -- don't return errors because
|
|
||||||
* the same errors should show up when the printing function pr_fn()
|
|
||||||
* is called, at which point the error goes onscreen.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/* as above, creates sr_secsid function */
|
|
||||||
CMP_INT(secsid) /* FLASK security ID, **NOT** a session ID -- ugh */
|
|
||||||
|
|
||||||
static int pr_secsid(char *restrict const outbuf, const proc_t *restrict const pp){
|
|
||||||
return sprintf(outbuf, "%d", (int) pp->secsid);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
// move the bulk of this to libproc sometime
|
||||||
static int pr_context(char *restrict const outbuf, const proc_t *restrict const pp){
|
static int pr_context(char *restrict const outbuf, const proc_t *restrict const pp){
|
||||||
char *ctxt; /* should be security_context_t */
|
char filename[48];
|
||||||
unsigned int len;
|
size_t len;
|
||||||
int rv;
|
ssize_t num_read;
|
||||||
|
int fd;
|
||||||
|
|
||||||
len = DEF_CTXTLEN;
|
// wchan file is suitable for testing
|
||||||
ctxt = (char *) calloc(1, len);
|
//snprintf(filename, sizeof filename, "/proc/%d/task/%d/wchan", pp->tgid, pp->tid);
|
||||||
if ( ctxt != NULL )
|
snprintf(filename, sizeof filename, "/proc/%d/task/%d/attr/current", pp->tgid, pp->tid);
|
||||||
rv = security_sid_to_context(pp->secsid, (security_context_t) ctxt, &len);
|
|
||||||
else
|
|
||||||
return sprintf(outbuf, "-");
|
|
||||||
|
|
||||||
if ( rv ) {
|
fd = open(filename, O_RDONLY, 0);
|
||||||
if ( errno != ENOSPC ) {
|
if(likely(fd==-1)) goto fail;
|
||||||
free(ctxt);
|
num_read = read(fd, outbuf, 666);
|
||||||
return sprintf(outbuf, "-");
|
close(fd);
|
||||||
} else {
|
if(unlikely(num_read<=0)) goto fail;
|
||||||
free(ctxt);
|
outbuf[num_read] = '\0';
|
||||||
ctxt = (char *) calloc(1, len);
|
|
||||||
if ( ctxt != NULL ) {
|
len = strspn(outbuf, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:_0123456789");
|
||||||
rv = security_sid_to_context(pp->secsid, (security_context_t) ctxt, &len);
|
if(!len) goto fail;
|
||||||
if ( rv ) {
|
outbuf[len] = '\0';
|
||||||
free(ctxt);
|
return len;
|
||||||
return sprintf(outbuf, "-");
|
|
||||||
} else {
|
fail:
|
||||||
rv = sprintf(outbuf, "%s", ctxt);
|
outbuf[0] = '-';
|
||||||
free(ctxt);
|
outbuf[1] = '\0';
|
||||||
return rv;
|
return 1;
|
||||||
}
|
|
||||||
} else { /* calloc() failed */
|
|
||||||
return sprintf(outbuf, "-");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
rv = sprintf(outbuf, "%s", ctxt);
|
|
||||||
free(ctxt);
|
|
||||||
return rv;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
static int sr_context ( const proc_t* P, const proc_t* Q ) {
|
|
||||||
char *ctxt_P, *ctxt_Q; /* type should be security_context_t */
|
|
||||||
unsigned int len;
|
|
||||||
int rv;
|
|
||||||
|
|
||||||
len = DEF_CTXTLEN;
|
|
||||||
ctxt_P = (char *) calloc(1, len);
|
|
||||||
ctxt_Q = (char *) calloc(1, len);
|
|
||||||
|
|
||||||
rv = security_sid_to_context(P->secsid, (security_context_t) ctxt_P, &len);
|
|
||||||
if ( rv ) {
|
|
||||||
if ( errno != ENOSPC ) {
|
|
||||||
free(ctxt_P);
|
|
||||||
/* error should resurface during printing */
|
|
||||||
return( 0 );
|
|
||||||
} else {
|
|
||||||
free(ctxt_P);
|
|
||||||
ctxt_P = (char *) calloc(1, len);
|
|
||||||
if ( ctxt_P != NULL ) {
|
|
||||||
rv = security_sid_to_context(P->secsid, (security_context_t) ctxt_P, &len);
|
|
||||||
if ( rv ) {
|
|
||||||
free(ctxt_P);
|
|
||||||
/* error should resurface during printing */
|
|
||||||
return( 0 );
|
|
||||||
}
|
|
||||||
} else { /* calloc() failed */
|
|
||||||
/* error should resurface during printing */
|
|
||||||
return( 0 );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
len = DEF_CTXTLEN;
|
|
||||||
|
|
||||||
rv = security_sid_to_context(Q->secsid, (security_context_t) ctxt_Q, &len);
|
|
||||||
if ( rv ) {
|
|
||||||
if ( errno != ENOSPC ) {
|
|
||||||
free(ctxt_P);
|
|
||||||
free(ctxt_Q);
|
|
||||||
/* error should resurface during printing */
|
|
||||||
return( 0 );
|
|
||||||
} else {
|
|
||||||
free(ctxt_Q);
|
|
||||||
ctxt_Q = (char *) calloc(1, len);
|
|
||||||
if ( ctxt_Q != NULL ) {
|
|
||||||
rv = security_sid_to_context(Q->secsid, (security_context_t) ctxt_Q, &len);
|
|
||||||
if ( rv ) {
|
|
||||||
free(ctxt_P);
|
|
||||||
free(ctxt_Q);
|
|
||||||
/* error should resurface during printing */
|
|
||||||
return( 0 );
|
|
||||||
}
|
|
||||||
} else { /* calloc() failed */
|
|
||||||
/* error should resurface during printing */
|
|
||||||
free(ctxt_P);
|
|
||||||
return( 0 );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
rv = strcmp(ctxt_P, ctxt_Q);
|
|
||||||
|
|
||||||
free(ctxt_P);
|
|
||||||
free(ctxt_Q);
|
|
||||||
|
|
||||||
return( rv );
|
|
||||||
}
|
|
||||||
|
|
||||||
#else
|
|
||||||
|
|
||||||
/****** dummy functions ******/
|
|
||||||
|
|
||||||
#define pr_secsid pr_nop
|
|
||||||
#define sr_secsid sr_nop
|
|
||||||
#define pr_context pr_nop
|
|
||||||
#define sr_context sr_nop
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/***************************************************************************/
|
/***************************************************************************/
|
||||||
/*************************** other stuff ***********************************/
|
/*************************** other stuff ***********************************/
|
||||||
|
|
||||||
@ -1164,7 +1052,7 @@ static const format_struct format_array[] = {
|
|||||||
{"cnswap", "-", pr_nop, sr_cnswap, 1, 0, LNX, AN|RIGHT},
|
{"cnswap", "-", pr_nop, sr_cnswap, 1, 0, LNX, AN|RIGHT},
|
||||||
{"comm", "COMMAND", pr_comm, sr_nop, 16, COM, U98, PO|UNLIMITED}, /*ucomm*/
|
{"comm", "COMMAND", pr_comm, sr_nop, 16, COM, U98, PO|UNLIMITED}, /*ucomm*/
|
||||||
{"command", "COMMAND", pr_args, sr_nop, 16, ARG, XXX, PO|UNLIMITED}, /*args*/
|
{"command", "COMMAND", pr_args, sr_nop, 16, ARG, XXX, PO|UNLIMITED}, /*args*/
|
||||||
{"context", "CONTEXT", pr_context, sr_context,40, 0, LNX, AN|LEFT},
|
{"context", "CONTEXT", pr_context, sr_nop, 40, 0, LNX, AN|LEFT},
|
||||||
{"cp", "CP", pr_cp, sr_pcpu, 3, 0, DEC, ET|RIGHT}, /*cpu*/
|
{"cp", "CP", pr_cp, sr_pcpu, 3, 0, DEC, ET|RIGHT}, /*cpu*/
|
||||||
{"cpu", "CPU", pr_nop, sr_nop, 3, 0, BSD, AN|RIGHT}, /* FIXME ... HP-UX wants this as the CPU number for SMP? */
|
{"cpu", "CPU", pr_nop, sr_nop, 3, 0, BSD, AN|RIGHT}, /* FIXME ... HP-UX wants this as the CPU number for SMP? */
|
||||||
{"cputime", "TIME", pr_time, sr_nop, 8, 0, DEC, ET|RIGHT}, /*time*/
|
{"cputime", "TIME", pr_time, sr_nop, 8, 0, DEC, ET|RIGHT}, /*time*/
|
||||||
@ -1275,7 +1163,6 @@ static const format_struct format_array[] = {
|
|||||||
{"sched", "SCH", pr_sched, sr_sched, 3, 0, AIX, TO|RIGHT},
|
{"sched", "SCH", pr_sched, sr_sched, 3, 0, AIX, TO|RIGHT},
|
||||||
{"scnt", "SCNT", pr_nop, sr_nop, 4, 0, DEC, AN|RIGHT}, /* man page misspelling of scount? */
|
{"scnt", "SCNT", pr_nop, sr_nop, 4, 0, DEC, AN|RIGHT}, /* man page misspelling of scount? */
|
||||||
{"scount", "SC", pr_nop, sr_nop, 4, 0, AIX, AN|RIGHT}, /* scnt==scount, DEC claims both */
|
{"scount", "SC", pr_nop, sr_nop, 4, 0, AIX, AN|RIGHT}, /* scnt==scount, DEC claims both */
|
||||||
{"secsid", "SID", pr_secsid, sr_secsid, 6, 0, LNX, AN|RIGHT}, /* Flask Linux */
|
|
||||||
{"sess", "SESS", pr_sess, sr_session, 5, 0, XXX, PO|PIDMAX|RIGHT},
|
{"sess", "SESS", pr_sess, sr_session, 5, 0, XXX, PO|PIDMAX|RIGHT},
|
||||||
{"session", "SESS", pr_sess, sr_session, 5, 0, LNX, PO|PIDMAX|RIGHT},
|
{"session", "SESS", pr_sess, sr_session, 5, 0, LNX, PO|PIDMAX|RIGHT},
|
||||||
{"sgi_p", "P", pr_sgi_p, sr_nop, 1, 0, LNX, TO|RIGHT}, /* "cpu" number */
|
{"sgi_p", "P", pr_sgi_p, sr_nop, 1, 0, LNX, TO|RIGHT}, /* "cpu" number */
|
||||||
@ -1398,8 +1285,7 @@ static const macro_struct macro_array[] = {
|
|||||||
|
|
||||||
{"FL5FMT", "f,state,uid,pid,ppid,pcpu,pri,nice,rss,wchan,start,time,command"}, /* Digital -fl */
|
{"FL5FMT", "f,state,uid,pid,ppid,pcpu,pri,nice,rss,wchan,start,time,command"}, /* Digital -fl */
|
||||||
|
|
||||||
{"FLASK_context", "pid,secsid,context,command"}, /* Flask Linux context, --context */
|
{"FLASK_context", "pid,context,command"}, /* Flask Linux context, --context */
|
||||||
{"FLASK_sid", "pid,secsid,command"}, /* Flask Linux SID, --SID */
|
|
||||||
|
|
||||||
{"HP_", "pid,tty,time,comm"}, /* HP default */
|
{"HP_", "pid,tty,time,comm"}, /* HP default */
|
||||||
{"HP_f", "user,pid,ppid,cpu,stime,tty,time,args"}, /* HP -f */
|
{"HP_f", "user,pid,ppid,cpu,stime,tty,time,args"}, /* HP -f */
|
||||||
|
@ -737,7 +737,6 @@ static const char *parse_gnu_option(void){
|
|||||||
gnu_table_struct *found;
|
gnu_table_struct *found;
|
||||||
static const gnu_table_struct gnu_table[] = {
|
static const gnu_table_struct gnu_table[] = {
|
||||||
{"Group", &&case_Group}, /* rgid */
|
{"Group", &&case_Group}, /* rgid */
|
||||||
{"SID", &&case_secsid},
|
|
||||||
{"User", &&case_User}, /* ruid */
|
{"User", &&case_User}, /* ruid */
|
||||||
{"cols", &&case_cols},
|
{"cols", &&case_cols},
|
||||||
{"columns", &&case_columns},
|
{"columns", &&case_columns},
|
||||||
@ -765,7 +764,6 @@ static const char *parse_gnu_option(void){
|
|||||||
{"pid", &&case_pid},
|
{"pid", &&case_pid},
|
||||||
{"ppid", &&case_ppid},
|
{"ppid", &&case_ppid},
|
||||||
{"rows", &&case_rows},
|
{"rows", &&case_rows},
|
||||||
{"secsid", &&case_secsid},
|
|
||||||
{"sid", &&case_sid},
|
{"sid", &&case_sid},
|
||||||
{"sort", &&case_sort},
|
{"sort", &&case_sort},
|
||||||
{"tty", &&case_tty},
|
{"tty", &&case_tty},
|
||||||
@ -954,10 +952,6 @@ static const char *parse_gnu_option(void){
|
|||||||
trace("--context\n");
|
trace("--context\n");
|
||||||
format_flags |= FF_Fc;
|
format_flags |= FF_Fc;
|
||||||
return NULL;
|
return NULL;
|
||||||
case_secsid:
|
|
||||||
trace("--secsid\n");
|
|
||||||
format_flags |= FF_Fs;
|
|
||||||
return NULL;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/*************** process trailing PIDs **********************/
|
/*************** process trailing PIDs **********************/
|
||||||
|
4
ps/ps.1
4
ps/ps.1
@ -97,8 +97,7 @@ s display signal format
|
|||||||
u display user-oriented format
|
u display user-oriented format
|
||||||
v display virtual memory format
|
v display virtual memory format
|
||||||
--format user-defined format
|
--format user-defined format
|
||||||
--context (SELinux only) Display security context format; implies --secsid
|
--context display security context format (NSA SELinux, etc.)
|
||||||
--secsid (SELinux only) Display Security ID
|
|
||||||
|
|
||||||
OUTPUT MODIFIERS
|
OUTPUT MODIFIERS
|
||||||
-H show process hierarchy (forest)
|
-H show process hierarchy (forest)
|
||||||
@ -410,7 +409,6 @@ rsz RSZ
|
|||||||
ruid RUID
|
ruid RUID
|
||||||
ruser RUSER
|
ruser RUSER
|
||||||
s S
|
s S
|
||||||
secsid SECSID
|
|
||||||
sess SESS
|
sess SESS
|
||||||
session SESS
|
session SESS
|
||||||
sgi_p P
|
sgi_p P
|
||||||
|
@ -860,9 +860,8 @@ const char *process_sf_options(int localbroken){
|
|||||||
case FF_LX: spec="OL_X"; break;
|
case FF_LX: spec="OL_X"; break;
|
||||||
case FF_Lm: spec="OL_m"; break;
|
case FF_Lm: spec="OL_m"; break;
|
||||||
|
|
||||||
/* These are FLASK security options. */
|
/* This is the sole FLASK security option. */
|
||||||
case FF_Fc: spec="FLASK_context"; break;
|
case FF_Fc: spec="FLASK_context"; break;
|
||||||
case FF_Fs: spec="FLASK_sid"; break;
|
|
||||||
|
|
||||||
} /* end switch(format_flags) */
|
} /* end switch(format_flags) */
|
||||||
|
|
||||||
|
2
sysctl.8
2
sysctl.8
@ -14,7 +14,7 @@ sysctl \- configure kernel parameters at runtime
|
|||||||
.br
|
.br
|
||||||
.B "sysctl [-n] [-e] -w variable=value ..."
|
.B "sysctl [-n] [-e] -w variable=value ..."
|
||||||
.br
|
.br
|
||||||
.B "sysctl [-n] [-e] -p <filename> (default /etc/sysctl.conf)"
|
.B "sysctl [-n] [-e] -p <filename>"
|
||||||
.br
|
.br
|
||||||
.B "sysctl [-n] [-e] -a"
|
.B "sysctl [-n] [-e] -a"
|
||||||
.br
|
.br
|
||||||
|
Loading…
Reference in New Issue
Block a user