libselinux/utils/sefcontext_compile.c - nest-cam/4320010/libselinux - Git at Google

 #include <ctype.h>
 #include <errno.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <getopt.h>
 #include <limits.h>
 #include <selinux/selinux.h>

 #include "../src/label_file.h"
 #include "../src/regex.h"

 static int validate_context(char __attribute__ ((unused)) **ctx)
 {
 	return 0;
 }

 static int process_file(struct selabel_handle *rec, const char *filename)
 {
 	unsigned int line_num;
 	int rc;
 	char *line_buf = NULL;
 	size_t line_len = 0;
 	FILE *context_file;
 	const char *prefix = NULL;

 	context_file = fopen(filename, "r");
 	if (!context_file) {
 		fprintf(stderr, "Error opening %s: %s\n",
 			    filename, strerror(errno));
 		return -1;
 	}

 	line_num = 0;
 	rc = 0;
 	while (getline(&line_buf, &line_len, context_file) > 0) {
 		rc = process_line(rec, filename, prefix, line_buf, ++line_num);
 		if (rc)
 			goto out;
 	}
 out:
 	free(line_buf);
 	fclose(context_file);
 	return rc;
 }

 /*
  * File Format
  *
  * u32 - magic number
  * u32 - version
  * u32 - length of pcre version EXCLUDING nul
  * char - pcre version string EXCLUDING nul
  * u32 - number of stems
  * ** Stems
  *	u32  - length of stem EXCLUDING nul
  *	char - stem char array INCLUDING nul
  * u32 - number of regexs
  * ** Regexes
  *	u32  - length of upcoming context INCLUDING nul
  *	char - char array of the raw context
  *	u32  - length of the upcoming regex_str
  *	char - char array of the original regex string including the stem.
  *	u32  - mode bits for >= SELINUX_COMPILED_FCONTEXT_MODE
  *	       mode_t for <= SELINUX_COMPILED_FCONTEXT_PCRE_VERS
  *	s32  - stemid associated with the regex
  *	u32  - spec has meta characters
  *	u32  - The specs prefix_len if >= SELINUX_COMPILED_FCONTEXT_PREFIX_LEN
  *	u32  - data length of the pcre regex
  *	char - a bufer holding the raw pcre regex info
  *	u32  - data length of the pcre regex study daya
  *	char - a buffer holding the raw pcre regex study data
  */
 static int write_binary_file(struct saved_data *data, int fd)
 {
 	struct spec *specs = data->spec_arr;
 	FILE *bin_file;
 	size_t len;
 	uint32_t magic = SELINUX_MAGIC_COMPILED_FCONTEXT;
 	uint32_t section_len;
 	uint32_t i;
 	int rc;

 	bin_file = fdopen(fd, "w");
 	if (!bin_file) {
 		perror("fopen output_file");
 		exit(EXIT_FAILURE);
 	}

 	/* write some magic number */
 	len = fwrite(&magic, sizeof(uint32_t), 1, bin_file);
 	if (len != 1)
 		goto err;

 	/* write the version */
 	section_len = SELINUX_COMPILED_FCONTEXT_MAX_VERS;
 	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
 	if (len != 1)
 		goto err;

 	/* write version of the regex back-end */
 	if (!regex_version())
 		goto err;
 	section_len = strlen(regex_version());
 	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
 	if (len != 1)
 		goto err;
 	len = fwrite(regex_version(), sizeof(char), section_len, bin_file);
 	if (len != section_len)
 		goto err;

 	/* write the number of stems coming */
 	section_len = data->num_stems;
 	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
 	if (len != 1)
 		goto err;

 	for (i = 0; i < section_len; i++) {
 		char *stem = data->stem_arr[i].buf;
 		uint32_t stem_len = data->stem_arr[i].len;

 		/* write the strlen (aka no nul) */
 		len = fwrite(&stem_len, sizeof(uint32_t), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* include the nul in the file */
 		stem_len += 1;
 		len = fwrite(stem, sizeof(char), stem_len, bin_file);
 		if (len != stem_len)
 			goto err;
 	}

 	/* write the number of regexes coming */
 	section_len = data->nspec;
 	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
 	if (len != 1)
 		goto err;

 	for (i = 0; i < section_len; i++) {
 		char *context = specs[i].lr.ctx_raw;
 		char *regex_str = specs[i].regex_str;
 		mode_t mode = specs[i].mode;
 		size_t prefix_len = specs[i].prefix_len;
 		int32_t stem_id = specs[i].stem_id;
 		struct regex_data *re = specs[i].regex;
 		uint32_t to_write;
 		size_t size;

 		/* length of the context string (including nul) */
 		to_write = strlen(context) + 1;
 		len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* original context strin (including nul) */
 		len = fwrite(context, sizeof(char), to_write, bin_file);
 		if (len != to_write)
 			goto err;

 		/* length of the original regex string (including nul) */
 		to_write = strlen(regex_str) + 1;
 		len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* original regex string */
 		len = fwrite(regex_str, sizeof(char), to_write, bin_file);
 		if (len != to_write)
 			goto err;

 		/* binary F_MODE bits */
 		to_write = mode;
 		len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* stem for this regex (could be -1) */
 		len = fwrite(&stem_id, sizeof(stem_id), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* does this spec have a metaChar? */
 		to_write = specs[i].hasMetaChars;
 		len = fwrite(&to_write, sizeof(to_write), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* For SELINUX_COMPILED_FCONTEXT_PREFIX_LEN */
 		to_write = prefix_len;
 		len = fwrite(&to_write, sizeof(to_write), 1, bin_file);
 		if (len != 1)
 			goto err;

 		/* Write regex related data */
 		rc = regex_writef(re, bin_file);
 		if (rc < 0)
 			goto err;
 	}

 	rc = 0;
 out:
 	fclose(bin_file);
 	return rc;
 err:
 	rc = -1;
 	goto out;
 }

 static void free_specs(struct saved_data *data)
 {
 	struct spec *specs = data->spec_arr;
 	unsigned int num_entries = data->nspec;
 	unsigned int i;

 	for (i = 0; i < num_entries; i++) {
 		free(specs[i].lr.ctx_raw);
 		free(specs[i].lr.ctx_trans);
 		free(specs[i].regex_str);
 		free(specs[i].type_str);
 		regex_data_free(specs[i].regex);
 	}
 	free(specs);

 	num_entries = data->num_stems;
 	for (i = 0; i < num_entries; i++)
 		free(data->stem_arr[i].buf);
 	free(data->stem_arr);

 	memset(data, 0, sizeof(*data));
 }

 static void usage(const char *progname)
 {
 	fprintf(stderr,
 		"usage: %s [-o out_file] fc_file\n"
 		"Where:\n\t"
 		"-o      Optional file name of the PCRE formatted binary\n\t"
 		"        file to be output. If not specified the default\n\t"
 		"        will be fc_file with the .bin suffix appended.\n\t"
 		"fc_file The text based file contexts file to be processed.\n",
 		progname);
 		exit(EXIT_FAILURE);
 }

 int main(int argc, char *argv[])
 {
 	const char *path = NULL;
 	const char *out_file = NULL;
 	char stack_path[PATH_MAX + 1];
 	char *tmp = NULL;
 	int fd, rc, opt;
 	struct stat buf;
 	struct selabel_handle *rec = NULL;
 	struct saved_data *data = NULL;

 	if (argc < 2)
 		usage(argv[0]);

 	while ((opt = getopt(argc, argv, "o:")) > 0) {
 		switch (opt) {
 		case 'o':
 			out_file = optarg;
 			break;
 		default:
 			usage(argv[0]);
 		}
 	}

 	if (optind >= argc)
 		usage(argv[0]);

 	path = argv[optind];
 	if (stat(path, &buf) < 0) {
 		fprintf(stderr, "Can not stat: %s: %m\n", path);
 		exit(EXIT_FAILURE);
 	}

 	/* Generate dummy handle for process_line() function */
 	rec = (struct selabel_handle *)calloc(1, sizeof(*rec));
 	if (!rec) {
 		fprintf(stderr, "Failed to calloc handle\n");
 		exit(EXIT_FAILURE);
 	}
 	rec->backend = SELABEL_CTX_FILE;

 	/* Need to set validation on to get the bin file generated by the
 	 * process_line function, however as the bin file being generated
 	 * may not be related to the currently loaded policy (that it
 	 * would be validated against), then set callback to ignore any
 	 * validation. */
 	rec->validating = 1;
 	selinux_set_callback(SELINUX_CB_VALIDATE,
 			    (union selinux_callback)&validate_context);

 	data = (struct saved_data *)calloc(1, sizeof(*data));
 	if (!data) {
 		fprintf(stderr, "Failed to calloc saved_data\n");
 		free(rec);
 		exit(EXIT_FAILURE);
 	}

 	rec->data = data;

 	rc = process_file(rec, path);
 	if (rc < 0)
 		goto err;

 	rc = sort_specs(data);
 	if (rc)
 		goto err;

 	if (out_file)
 		rc = snprintf(stack_path, sizeof(stack_path), "%s", out_file);
 	else
 		rc = snprintf(stack_path, sizeof(stack_path), "%s.bin", path);

 	if (rc < 0 || rc >= (int)sizeof(stack_path))
 		goto err;

 	tmp = malloc(strlen(stack_path) + 7);
 	if (!tmp)
 		goto err;

 	rc = sprintf(tmp, "%sXXXXXX", stack_path);
 	if (rc < 0)
 		goto err;

 	fd  = mkstemp(tmp);
 	if (fd < 0)
 		goto err;

 	rc = fchmod(fd, buf.st_mode);
 	if (rc < 0) {
 		perror("fchmod failed to set permission on compiled regexs");
 		goto err_unlink;
 	}

 	rc = write_binary_file(data, fd);
 	if (rc < 0)
 		goto err_unlink;

 	rc = rename(tmp, stack_path);
 	if (rc < 0)
 		goto err_unlink;

 	rc = 0;
 out:
 	free_specs(data);
 	free(rec);
 	free(data);
 	free(tmp);
 	return rc;

 err_unlink:
 	unlink(tmp);
 err:
 	rc = -1;
 	goto out;
 }
	#include <ctype.h>
	#include <errno.h>
	#include <stdint.h>
	#include <stdio.h>
	#include <string.h>
	#include <unistd.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <getopt.h>
	#include <limits.h>
	#include <selinux/selinux.h>

	#include "../src/label_file.h"
	#include "../src/regex.h"

	static int validate_context(char __attribute__ ((unused)) **ctx)
	{
	return 0;
	}

	static int process_file(struct selabel_handle rec, const char filename)
	{
	unsigned int line_num;
	int rc;
	char *line_buf = NULL;
	size_t line_len = 0;
	FILE *context_file;
	const char *prefix = NULL;

	context_file = fopen(filename, "r");
	if (!context_file) {
	fprintf(stderr, "Error opening %s: %s\n",
	filename, strerror(errno));
	return -1;
	}

	line_num = 0;
	rc = 0;
	while (getline(&line_buf, &line_len, context_file) > 0) {
	rc = process_line(rec, filename, prefix, line_buf, ++line_num);
	if (rc)
	goto out;
	}
	out:
	free(line_buf);
	fclose(context_file);
	return rc;
	}

	/*
	* File Format
	*
	* u32 - magic number
	* u32 - version
	* u32 - length of pcre version EXCLUDING nul
	* char - pcre version string EXCLUDING nul
	* u32 - number of stems
	* ** Stems
	* u32 - length of stem EXCLUDING nul
	* char - stem char array INCLUDING nul
	* u32 - number of regexs
	* ** Regexes
	* u32 - length of upcoming context INCLUDING nul
	* char - char array of the raw context
	* u32 - length of the upcoming regex_str
	* char - char array of the original regex string including the stem.
	* u32 - mode bits for >= SELINUX_COMPILED_FCONTEXT_MODE
	* mode_t for <= SELINUX_COMPILED_FCONTEXT_PCRE_VERS
	* s32 - stemid associated with the regex
	* u32 - spec has meta characters
	* u32 - The specs prefix_len if >= SELINUX_COMPILED_FCONTEXT_PREFIX_LEN
	* u32 - data length of the pcre regex
	* char - a bufer holding the raw pcre regex info
	* u32 - data length of the pcre regex study daya
	* char - a buffer holding the raw pcre regex study data
	*/
	static int write_binary_file(struct saved_data *data, int fd)
	{
	struct spec *specs = data->spec_arr;
	FILE *bin_file;
	size_t len;
	uint32_t magic = SELINUX_MAGIC_COMPILED_FCONTEXT;
	uint32_t section_len;
	uint32_t i;
	int rc;

	bin_file = fdopen(fd, "w");
	if (!bin_file) {
	perror("fopen output_file");
	exit(EXIT_FAILURE);
	}

	/* write some magic number */
	len = fwrite(&magic, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* write the version */
	section_len = SELINUX_COMPILED_FCONTEXT_MAX_VERS;
	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* write version of the regex back-end */
	if (!regex_version())
	goto err;
	section_len = strlen(regex_version());
	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;
	len = fwrite(regex_version(), sizeof(char), section_len, bin_file);
	if (len != section_len)
	goto err;

	/* write the number of stems coming */
	section_len = data->num_stems;
	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	for (i = 0; i < section_len; i++) {
	char *stem = data->stem_arr[i].buf;
	uint32_t stem_len = data->stem_arr[i].len;

	/* write the strlen (aka no nul) */
	len = fwrite(&stem_len, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* include the nul in the file */
	stem_len += 1;
	len = fwrite(stem, sizeof(char), stem_len, bin_file);
	if (len != stem_len)
	goto err;
	}

	/* write the number of regexes coming */
	section_len = data->nspec;
	len = fwrite(&section_len, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	for (i = 0; i < section_len; i++) {
	char *context = specs[i].lr.ctx_raw;
	char *regex_str = specs[i].regex_str;
	mode_t mode = specs[i].mode;
	size_t prefix_len = specs[i].prefix_len;
	int32_t stem_id = specs[i].stem_id;
	struct regex_data *re = specs[i].regex;
	uint32_t to_write;
	size_t size;

	/* length of the context string (including nul) */
	to_write = strlen(context) + 1;
	len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* original context strin (including nul) */
	len = fwrite(context, sizeof(char), to_write, bin_file);
	if (len != to_write)
	goto err;

	/* length of the original regex string (including nul) */
	to_write = strlen(regex_str) + 1;
	len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* original regex string */
	len = fwrite(regex_str, sizeof(char), to_write, bin_file);
	if (len != to_write)
	goto err;

	/* binary F_MODE bits */
	to_write = mode;
	len = fwrite(&to_write, sizeof(uint32_t), 1, bin_file);
	if (len != 1)
	goto err;

	/* stem for this regex (could be -1) */
	len = fwrite(&stem_id, sizeof(stem_id), 1, bin_file);
	if (len != 1)
	goto err;

	/* does this spec have a metaChar? */
	to_write = specs[i].hasMetaChars;
	len = fwrite(&to_write, sizeof(to_write), 1, bin_file);
	if (len != 1)
	goto err;

	/* For SELINUX_COMPILED_FCONTEXT_PREFIX_LEN */
	to_write = prefix_len;
	len = fwrite(&to_write, sizeof(to_write), 1, bin_file);
	if (len != 1)
	goto err;

	/* Write regex related data */
	rc = regex_writef(re, bin_file);
	if (rc < 0)
	goto err;
	}

	rc = 0;
	out:
	fclose(bin_file);
	return rc;
	err:
	rc = -1;
	goto out;
	}

	static void free_specs(struct saved_data *data)
	{
	struct spec *specs = data->spec_arr;
	unsigned int num_entries = data->nspec;
	unsigned int i;

	for (i = 0; i < num_entries; i++) {
	free(specs[i].lr.ctx_raw);
	free(specs[i].lr.ctx_trans);
	free(specs[i].regex_str);
	free(specs[i].type_str);
	regex_data_free(specs[i].regex);
	}
	free(specs);

	num_entries = data->num_stems;
	for (i = 0; i < num_entries; i++)
	free(data->stem_arr[i].buf);
	free(data->stem_arr);

	memset(data, 0, sizeof(*data));
	}

	static void usage(const char *progname)
	{
	fprintf(stderr,
	"usage: %s [-o out_file] fc_file\n"
	"Where:\n\t"
	"-o Optional file name of the PCRE formatted binary\n\t"
	" file to be output. If not specified the default\n\t"
	" will be fc_file with the .bin suffix appended.\n\t"
	"fc_file The text based file contexts file to be processed.\n",
	progname);
	exit(EXIT_FAILURE);
	}

	int main(int argc, char *argv[])
	{
	const char *path = NULL;
	const char *out_file = NULL;
	char stack_path[PATH_MAX + 1];
	char *tmp = NULL;
	int fd, rc, opt;
	struct stat buf;
	struct selabel_handle *rec = NULL;
	struct saved_data *data = NULL;

	if (argc < 2)
	usage(argv[0]);

	while ((opt = getopt(argc, argv, "o:")) > 0) {
	switch (opt) {
	case 'o':
	out_file = optarg;
	break;
	default:
	usage(argv[0]);
	}
	}

	if (optind >= argc)
	usage(argv[0]);

	path = argv[optind];
	if (stat(path, &buf) < 0) {
	fprintf(stderr, "Can not stat: %s: %m\n", path);
	exit(EXIT_FAILURE);
	}

	/* Generate dummy handle for process_line() function */
	rec = (struct selabel_handle )calloc(1, sizeof(rec));
	if (!rec) {
	fprintf(stderr, "Failed to calloc handle\n");
	exit(EXIT_FAILURE);
	}
	rec->backend = SELABEL_CTX_FILE;

	/* Need to set validation on to get the bin file generated by the
	* process_line function, however as the bin file being generated
	* may not be related to the currently loaded policy (that it
	* would be validated against), then set callback to ignore any
	* validation. */
	rec->validating = 1;
	selinux_set_callback(SELINUX_CB_VALIDATE,
	(union selinux_callback)&validate_context);

	data = (struct saved_data )calloc(1, sizeof(data));
	if (!data) {
	fprintf(stderr, "Failed to calloc saved_data\n");
	free(rec);
	exit(EXIT_FAILURE);
	}

	rec->data = data;

	rc = process_file(rec, path);
	if (rc < 0)
	goto err;

	rc = sort_specs(data);
	if (rc)
	goto err;

	if (out_file)
	rc = snprintf(stack_path, sizeof(stack_path), "%s", out_file);
	else
	rc = snprintf(stack_path, sizeof(stack_path), "%s.bin", path);

	if (rc < 0 \|\| rc >= (int)sizeof(stack_path))
	goto err;

	tmp = malloc(strlen(stack_path) + 7);
	if (!tmp)
	goto err;

	rc = sprintf(tmp, "%sXXXXXX", stack_path);
	if (rc < 0)
	goto err;

	fd = mkstemp(tmp);
	if (fd < 0)
	goto err;

	rc = fchmod(fd, buf.st_mode);
	if (rc < 0) {
	perror("fchmod failed to set permission on compiled regexs");
	goto err_unlink;
	}

	rc = write_binary_file(data, fd);
	if (rc < 0)
	goto err_unlink;

	rc = rename(tmp, stack_path);
	if (rc < 0)
	goto err_unlink;

	rc = 0;
	out:
	free_specs(data);
	free(rec);
	free(data);
	free(tmp);
	return rc;

	err_unlink:
	unlink(tmp);
	err:
	rc = -1;
	goto out;
	}