* lib/protoypes.h, libmisc/copydir.c, src/useradd.c:

	selinux_file_context renamed set_selinux_file_context.
	* lib/protoypes.h, libmisc/copydir.c, src/useradd.c:
	Added reset_selinux_file_context.
	* src/useradd.c: Check the return value of
	set_selinux_file_context and reset_selinux_file_context.
	* libmisc/copydir.c: Check the return value of
	reset_selinux_file_context.

diff --git a/ChangeLog b/ChangeLog
index 9d8adf860b78c0b58c8ce9e0fa23d7a128a69cc5..95db96d43aaa11c2d9b1b73f5a3cf0264cef4458 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2010-08-28  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * lib/protoypes.h, libmisc/copydir.c, src/useradd.c:
+       selinux_file_context renamed set_selinux_file_context.
+       * lib/protoypes.h, libmisc/copydir.c, src/useradd.c:
+       Added reset_selinux_file_context.
+       * src/useradd.c: Check the return value of
+       set_selinux_file_context and reset_selinux_file_context.
+       * libmisc/copydir.c: Check the return value of
+       reset_selinux_file_context.
+
 2010-08-28  Nicolas François  <nicolas.francois@centraliens.net>
 
        * src/su.c: Fix handling of environment variables when

diff --git a/lib/prototypes.h b/lib/prototypes.h
index 8f9db9c634190fc59daf0b1b690e574bc688191b..a8993268a840311fb22f74c6bf696fc0793c335d 100644 (file)
--- a/lib/prototypes.h
+++ b/lib/prototypes.h
@@ -123,7 +123,8 @@ extern int copy_tree (const char *src_root, const char *dst_root,
                       uid_t old_uid, uid_t new_uid,
                       gid_t old_gid, gid_t new_gid);
 #ifdef WITH_SELINUX
-extern int selinux_file_context (const char *dst_name);
+extern int set_selinux_file_context (const char *dst_name);
+extern int reset_selinux_file_context (void);
 #endif
 
 /* encrypt.c */

diff --git a/libmisc/copydir.c b/libmisc/copydir.c
index c4a561da68fd6c340f26560bf2d882aa148985af..85155ae4ac0ff292f0f4f0b52efb3380356fd67f 100644 (file)
--- a/libmisc/copydir.c
+++ b/libmisc/copydir.c
@@ -55,6 +55,11 @@
 #include <attr/libattr.h>
 #endif                         /* WITH_ATTR */
 
+#ifdef WITH_SELINUX
+static bool selinux_checked = false;
+static bool selinux_enabled;
+#endif                         /* WITH_SELINUX */
+
 static /*@null@*/const char *src_orig;
 static /*@null@*/const char *dst_orig;
 
@@ -109,20 +114,17 @@ static int fchown_if_needed (int fdst, const struct stat *statp,
 
 #ifdef WITH_SELINUX
 /*
- * selinux_file_context - Set the security context before any file or
- *                        directory creation.
+ * set_selinux_file_context - Set the security context before any file or
+ *                            directory creation.
  *
- *     selinux_file_context () should be called before any creation of file,
- *     symlink, directory, ...
+ *     set_selinux_file_context () should be called before any creation
+ *     of file, symlink, directory, ...
  *
  *     Callers may have to Reset SELinux to create files with default
- *     contexts:
- *             setfscreatecon (NULL);
+ *     contexts with reset_selinux_file_context
  */
-int selinux_file_context (const char *dst_name)
+int set_selinux_file_context (const char *dst_name)
 {
-       static bool selinux_checked = false;
-       static bool selinux_enabled;
        /*@null@*/security_context_t scontext = NULL;
 
        if (!selinux_checked) {
@@ -147,6 +149,27 @@ int selinux_file_context (const char *dst_name)
        }
        return 0;
 }
+
+/*
+ * reset_selinux_file_context - Reset the security context to the default
+ *                              policy behavior
+ *
+ *     reset_selinux_file_context () should be called after the context
+ *     was changed with set_selinux_file_context ()
+ */
+int reset_selinux_file_context (void)
+{
+       if (!selinux_checked) {
+               selinux_enabled = is_selinux_enabled () > 0;
+               selinux_checked = true;
+       }
+       if (selinux_enabled) {
+               if (setfscreatecon (NULL) != 0) {
+                       return 1;
+               }
+       }
+       return 0;
+}
 #endif                         /* WITH_SELINUX */
 
 #if defined(WITH_ACL) || defined(WITH_ATTR)
@@ -373,8 +396,14 @@ int copy_tree (const char *src_root, const char *dst_root,
        }
 
 #ifdef WITH_SELINUX
-       /* Reset SELinux to create files with default contexts */
-       if (setfscreatecon (NULL) != 0) {
+       /* Reset SELinux to create files with default contexts.
+        * Note that the context is only reset on exit of copy_tree (it is
+        * assumed that the program would quit without needing a restored
+        * context if copy_tree failed previously), and that copy_tree can
+        * be called recursively (hence the context is set on the
+        * sub-functions of copy_entry).
+        */
+       if (reset_selinux_file_context () != 0) {
                err = -1;
        }
 #endif                         /* WITH_SELINUX */
@@ -511,7 +540,7 @@ static int copy_dir (const char *src, const char *dst,
         */
 
 #ifdef WITH_SELINUX
-       if (selinux_file_context (dst) != 0) {
+       if (set_selinux_file_context (dst) != 0) {
                return -1;
        }
 #endif                         /* WITH_SELINUX */
@@ -629,7 +658,7 @@ static int copy_symlink (const char *src, const char *dst,
        }
 
 #ifdef WITH_SELINUX
-       if (selinux_file_context (dst) != 0) {
+       if (set_selinux_file_context (dst) != 0) {
                free (oldlink);
                return -1;
        }
@@ -708,7 +737,7 @@ static int copy_special (const char *src, const char *dst,
        int err = 0;
 
 #ifdef WITH_SELINUX
-       if (selinux_file_context (dst) != 0) {
+       if (set_selinux_file_context (dst) != 0) {
                return -1;
        }
 #endif                         /* WITH_SELINUX */
@@ -765,7 +794,7 @@ static int copy_file (const char *src, const char *dst,
                return -1;
        }
 #ifdef WITH_SELINUX
-       if (selinux_file_context (dst) != 0) {
+       if (set_selinux_file_context (dst) != 0) {
                return -1;
        }
 #endif                         /* WITH_SELINUX */

diff --git a/src/useradd.c b/src/useradd.c
index e8348b9f0718fa484c37e6c25b920d9aad2ceeae..b7d51715b6520907f18884428bd1c6a7740ddf25 100644 (file)
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -1764,7 +1764,9 @@ static void create_home (void)
 {
        if (access (user_home, F_OK) != 0) {
 #ifdef WITH_SELINUX
-               selinux_file_context (user_home);
+               if (set_selinux_file_context (user_home) != 0) {
+                       fail_exit (E_HOMEDIR);
+               }
 #endif
                /* XXX - create missing parent directories.  --marekm */
                if (mkdir (user_home, 0) != 0) {
@@ -1791,7 +1793,9 @@ static void create_home (void)
 #endif
 #ifdef WITH_SELINUX
                /* Reset SELinux to create files with default contexts */
-               setfscreatecon (NULL);
+               if (reset_selinux_file_context () != 0) {
+                       fail_exit (E_HOMEDIR);
+               }
 #endif
        }
 }