Re: [fuse-devel] Fixed loss of SELinux file context on /etc/mtab - patch included

[Yves P. <yv...@xp...>]

Just realised the patch I sent left a variable declaration outside of an 
#ifdef, which would break the build on a platform without SELinux 
installed. I'm attaching an updated version.

  ..Yves

Yves Perrenoud wrote:
> There's currently a potential problem with fusermount on a system that
> makes use of SELinux, as the file context is not preserved on /etc/mtab
> when the file is recreated after the removal of a fuse entry.
> 
> This specifically affects Fedora Core 5, as /etc/mtab has a specific
> label (etc_runtime_t), which is different from the default (etc_t) that
> a file created in that directory would inherit. This subsequently
> prevents a number of other processes or commands in specific contexts
> from being able to read or write /etc/mtab, thus causing a number of
> selinux errors when for instance simply using the "ip" command (somehow
> it wants to read /etc/mtab), or during shutdown (mount/umount are
> obviously affected). Here's a bug report showing some details:
> 
>    https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188561
> 
> The solution to the problem is simply to restore the original file's
> security context in unmount_rename(). I'm attaching a patch for 2.5.3
> that achieves exactly that. It also modifies configure.in to check for
> the appropriate header and library, and hence has conditionals in the
> code so that if selinux is not installed, it won't use it.
> 
>   ..Yves
> 
> 
> ------------------------------------------------------------------------
> 
> *** configure.in.orig	2006-04-10 01:43:46.000000000 -0700
> --- configure.in	2006-07-26 22:39:34.499379631 -0700
> ***************
> *** 77,81 ****
> --- 77,83 ----
>   AM_CONDITIONAL(LINUX, test "$arch" = linux)
>   AM_CONDITIONAL(BSD, test "$arch" = bsd)
>   
> + AC_CHECK_HEADERS(selinux/selinux.h, AC_CHECK_LIB(selinux, getfilecon))
> + 
>   AC_CONFIG_FILES([fuse.pc Makefile lib/Makefile util/Makefile example/Makefile include/Makefile])
>   AC_OUTPUT
> *** util/fusermount.c.orig	2006-02-02 09:04:53.000000000 -0800
> --- util/fusermount.c	2006-07-26 22:40:39.327169948 -0700
> ***************
> *** 39,44 ****
> --- 39,48 ----
>   #include <sys/utsname.h>
>   #include <sys/sysmacros.h>
>   
> + #ifdef HAVE_SELINUX_SELINUX_H
> + #include <selinux/selinux.h>
> + #endif
> + 
>   #define FUSE_COMMFD_ENV         "_FUSE_COMMFD"
>   
>   #define FUSE_DEV_OLD "/proc/fs/fuse/dev"
> ***************
> *** 181,190 ****
> --- 185,203 ----
>   {
>       int res;
>       struct stat sbuf;
> +     security_context_t filecon;
>   
>       if (stat(mtab, &sbuf) == 0)
>           chown(mtab_new, sbuf.st_uid, sbuf.st_gid);
>   
> + #ifdef HAVE_LIBSELINUX
> +     if (getfilecon(mtab, &filecon) > 0) {
> +         setfilecon(mtab_new, filecon);
> +         if (filecon != NULL)
> +             freecon(filecon);
> +     }
> + #endif
> + 
>       res = rename(mtab_new, mtab);
>       if (res == -1) {
>           fprintf(stderr, "%s: failed to rename %s to %s: %s\n", progname,
>