tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libsemanage: always write kernel policy when check_ext_changes is specified

Browse source 
For the use case of rebuilding the policy after package updates, we need
the check_ext_changes operation to always do at least the do_write_kernel
step, because the various semanage dbs may have also changed content
relative to the current binary policy. As this step is itself relatively
fast, we can do it unconditionally.

Fixes: 286a679fad ("libsemanage: optionally rebuild policy when modules are changed externally")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Ondrej Mosnacek 2022-06-08 19:09:53 +02:00 committed by Nicolas Iooss
parent 344463076b
commit bdbe52be1b
No known key found for this signature in database
GPG key ID: ACE831CD793E2C98
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
libsemanage/include/semanage/handle.h
View file

@ -67,7 +67,7 @@ extern void semanage_set_reload(semanage_handle_t * handle, int do_reload);
extern void semanage_set_rebuild(semanage_handle_t * handle, int do_rebuild); extern void semanage_set_rebuild(semanage_handle_t * handle, int do_rebuild);
/* set whether to rebuild the policy on commit when potential changes /* set whether to rebuild the policy on commit when potential changes
* to module files since last rebuild are detected, * to store files since last rebuild are detected,
* 1 for yes (default), 0 for no */ * 1 for yes (default), 0 for no */
extern void semanage_set_check_ext_changes(semanage_handle_t * handle, int do_check); extern void semanage_set_check_ext_changes(semanage_handle_t * handle, int do_check);

8
libsemanage/src/direct_api.c
View file

@ -1437,13 +1437,15 @@ static int semanage_direct_commit(semanage_handle_t * sh)
* Determine what else needs to be done. * Determine what else needs to be done.
* We need to write the kernel policy if we are rebuilding * We need to write the kernel policy if we are rebuilding
* or if any other policy component that lives in the kernel * or if any other policy component that lives in the kernel
* policy has been modified. * policy has been modified. We also want to force it when
* check_ext_changes was specified as the various dbases may have
* changes as well.
* We need to install the policy files if any of the managed files * We need to install the policy files if any of the managed files
* that live under /etc/selinux (kernel policy, seusers, file contexts) * that live under /etc/selinux (kernel policy, seusers, file contexts)
* will be modified. * will be modified.
*/ */
do_write_kernel = do_rebuild | ports_modified | ibpkeys_modified | do_write_kernel = do_rebuild | sh->check_ext_changes |
ibendports_modified | ports_modified | ibpkeys_modified | ibendports_modified |
bools->dtable->is_modified(bools->dbase) | bools->dtable->is_modified(bools->dbase) |
ifaces->dtable->is_modified(ifaces->dbase) | ifaces->dtable->is_modified(ifaces->dbase) |
nodes->dtable->is_modified(nodes->dbase) | nodes->dtable->is_modified(nodes->dbase) |