|
From: Yves P. <yv...@xp...> - 2006-07-27 17:52:01
|
Just realised the patch I sent left a variable declaration outside of an #ifdef, which would break the build on a platform without SELinux installed. I'm attaching an updated version. ..Yves Yves Perrenoud wrote: > There's currently a potential problem with fusermount on a system that > makes use of SELinux, as the file context is not preserved on /etc/mtab > when the file is recreated after the removal of a fuse entry. > > This specifically affects Fedora Core 5, as /etc/mtab has a specific > label (etc_runtime_t), which is different from the default (etc_t) that > a file created in that directory would inherit. This subsequently > prevents a number of other processes or commands in specific contexts > from being able to read or write /etc/mtab, thus causing a number of > selinux errors when for instance simply using the "ip" command (somehow > it wants to read /etc/mtab), or during shutdown (mount/umount are > obviously affected). Here's a bug report showing some details: > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188561 > > The solution to the problem is simply to restore the original file's > security context in unmount_rename(). I'm attaching a patch for 2.5.3 > that achieves exactly that. It also modifies configure.in to check for > the appropriate header and library, and hence has conditionals in the > code so that if selinux is not installed, it won't use it. > > ..Yves > > > ------------------------------------------------------------------------ > > *** configure.in.orig 2006-04-10 01:43:46.000000000 -0700 > --- configure.in 2006-07-26 22:39:34.499379631 -0700 > *************** > *** 77,81 **** > --- 77,83 ---- > AM_CONDITIONAL(LINUX, test "$arch" = linux) > AM_CONDITIONAL(BSD, test "$arch" = bsd) > > + AC_CHECK_HEADERS(selinux/selinux.h, AC_CHECK_LIB(selinux, getfilecon)) > + > AC_CONFIG_FILES([fuse.pc Makefile lib/Makefile util/Makefile example/Makefile include/Makefile]) > AC_OUTPUT > *** util/fusermount.c.orig 2006-02-02 09:04:53.000000000 -0800 > --- util/fusermount.c 2006-07-26 22:40:39.327169948 -0700 > *************** > *** 39,44 **** > --- 39,48 ---- > #include <sys/utsname.h> > #include <sys/sysmacros.h> > > + #ifdef HAVE_SELINUX_SELINUX_H > + #include <selinux/selinux.h> > + #endif > + > #define FUSE_COMMFD_ENV "_FUSE_COMMFD" > > #define FUSE_DEV_OLD "/proc/fs/fuse/dev" > *************** > *** 181,190 **** > --- 185,203 ---- > { > int res; > struct stat sbuf; > + security_context_t filecon; > > if (stat(mtab, &sbuf) == 0) > chown(mtab_new, sbuf.st_uid, sbuf.st_gid); > > + #ifdef HAVE_LIBSELINUX > + if (getfilecon(mtab, &filecon) > 0) { > + setfilecon(mtab_new, filecon); > + if (filecon != NULL) > + freecon(filecon); > + } > + #endif > + > res = rename(mtab_new, mtab); > if (res == -1) { > fprintf(stderr, "%s: failed to rename %s to %s: %s\n", progname, > |