@@ -2513,6 +2513,8 @@ static int write_genfscon_rules_to_conf(FILE *out, struct policydb *pdb)
struct ocontext *ocon;
struct strs *strs;
char *fstype, *name, *ctx;
+ uint32_t sclass;
+ const char *file_type;
int rc;
rc = strs_init(&strs, 32);
@@ -2525,14 +2527,43 @@ static int write_genfscon_rules_to_conf(FILE *out, struct policydb *pdb)
fstype = genfs->fstype;
name = ocon->u.name;
+ sclass = ocon->v.sclass;
+ file_type = NULL;
+ if (sclass) {
+ const char *class_name = pdb->p_class_val_to_name[sclass-1];
+ if (strcmp(class_name, "blk_file") == 0) {
+ file_type = "-b";
+ } else if (strcmp(class_name, "chr_file") == 0) {
+ file_type = "-c";
+ } else if (strcmp(class_name, "dir") == 0) {
+ file_type = "-d";
+ } else if (strcmp(class_name, "fifo_file") == 0) {
+ file_type = "-p";
+ } else if (strcmp(class_name, "lnk_file") == 0) {
+ file_type = "-l";
+ } else if (strcmp(class_name, "sock_file") == 0) {
+ file_type = "-s";
+ } else if (strcmp(class_name, "file") == 0) {
+ file_type = "--";
+ } else {
+ rc = -1;
+ goto exit;
+ }
+ }
+
ctx = context_to_str(pdb, &ocon->context[0]);
if (!ctx) {
rc = -1;
goto exit;
}
- rc = strs_create_and_add(strs, "genfscon %s \"%s\" %s", 3,
- fstype, name, ctx);
+ if (file_type) {
+ rc = strs_create_and_add(strs, "genfscon %s \"%s\" %s %s", 4,
+ fstype, name, file_type, ctx);
+ } else {
+ rc = strs_create_and_add(strs, "genfscon %s \"%s\" %s", 3,
+ fstype, name, ctx);
+ }
free(ctx);
if (rc != 0) {
goto exit;
Although rarely used, genfscon rules support the specification of a file type just like the rules in a file context file. The file type is used to make the genfscon rule apply only for a specific security class. Currently, when writing out a policy.conf file from a kernel policy, it is assumed that every genfscon rule applies to all security classes and no file type will be added to the genfscon rule. Write out the appropriate file type if the genfscon rule is only for a specific security class (file, dir, blk_file, chr_file, fifo_file, lnk_file, or sock_file). Signed-off-by: James Carter <jwcart2@gmail.com> --- libsepol/src/kernel_to_conf.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-)