diff mbox series

[RFC,13/24] libselinux/utils: introduce selabel_compare

Message ID 20230811162731.50697-14-cgzones@googlemail.com (mailing list archive)
State Superseded
Delegated to: Petr Lautrbach
Headers show
Series libselinux: rework selabel_file(5) database | expand

Commit Message

Christian Göttsche Aug. 11, 2023, 4:27 p.m. UTC
Add a utility around selabel_cmp(3).

Can be used by users to compare a pre-compiled fcontext file to an
original text-based file context definition file.

Can be used for development to verify compilation and parsing of the
pre-compiled fcontext format works correctly.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libselinux/utils/.gitignore        |   1 +
 libselinux/utils/selabel_compare.c | 119 +++++++++++++++++++++++++++++
 2 files changed, 120 insertions(+)
 create mode 100644 libselinux/utils/selabel_compare.c
diff mbox series

Patch

diff --git a/libselinux/utils/.gitignore b/libselinux/utils/.gitignore
index a92e1e94..4e2dfba8 100644
--- a/libselinux/utils/.gitignore
+++ b/libselinux/utils/.gitignore
@@ -16,6 +16,7 @@  getseuser
 matchpathcon
 policyvers
 sefcontext_compile
+selabel_compare
 selabel_digest
 selabel_get_digests_all_partial_matches
 selabel_lookup
diff --git a/libselinux/utils/selabel_compare.c b/libselinux/utils/selabel_compare.c
new file mode 100644
index 00000000..f4325f7e
--- /dev/null
+++ b/libselinux/utils/selabel_compare.c
@@ -0,0 +1,119 @@ 
+#include <getopt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <selinux/label.h>
+
+
+static void usage(const char *progname)
+{
+	fprintf(stderr,
+		"usage: %s [-b backend] [-v] file1 file2\n\n"
+		"Where:\n\t"
+		"-b           The backend - \"file\", \"media\", \"x\", \"db\" or \"prop\" (defaults to \"file\")\n\t"
+		"-v           Validate entries against loaded policy.\n\t"
+		"file1/file2  Files containing the specs.\n",
+		progname);
+}
+
+int main(int argc, char *argv[])
+{
+	unsigned int backend = SELABEL_CTX_FILE;
+	int opt;
+	const char *validate = NULL, *file1 = NULL, *file2 = NULL;
+
+	if (argc < 3) {
+		usage(argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	while ((opt = getopt(argc, argv, "b:v")) > 0) {
+		switch (opt) {
+		case 'b':
+			if (!strcasecmp(optarg, "file")) {
+				backend = SELABEL_CTX_FILE;
+			} else if (!strcmp(optarg, "media")) {
+				backend = SELABEL_CTX_MEDIA;
+			} else if (!strcmp(optarg, "x")) {
+				backend = SELABEL_CTX_X;
+			} else if (!strcmp(optarg, "db")) {
+				backend = SELABEL_CTX_DB;
+			} else if (!strcmp(optarg, "prop")) {
+				backend = SELABEL_CTX_ANDROID_PROP;
+			} else if (!strcmp(optarg, "service")) {
+				backend = SELABEL_CTX_ANDROID_SERVICE;
+			} else {
+				fprintf(stderr, "Unknown backend: %s\n", optarg);
+				usage(argv[0]);
+				return EXIT_FAILURE;
+			}
+			break;
+		case 'v':
+			validate = (char *)1;
+			break;
+		default:
+			usage(argv[0]);
+			return EXIT_FAILURE;
+		}
+	}
+
+	if (argc != optind + 2) {
+		usage(argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	file1 = argv[optind++];
+	file2 = argv[optind];
+
+	{
+		struct selabel_handle *hnd1, *hnd2;
+		const struct selinux_opt selabel_option1[] = {
+			{ SELABEL_OPT_PATH, file1 },
+			{ SELABEL_OPT_VALIDATE, validate }
+		};
+		const struct selinux_opt selabel_option2[] = {
+			{ SELABEL_OPT_PATH, file2 },
+			{ SELABEL_OPT_VALIDATE, validate }
+		};
+		enum selabel_cmp_result result;
+
+		hnd1 = selabel_open(backend, selabel_option1, 2);
+		if (!hnd1) {
+			fprintf(stderr, "ERROR: selabel_open - Could not obtain handle for %s:  %m\n", file1);
+			return EXIT_FAILURE;
+		}
+
+		hnd2 = selabel_open(backend, selabel_option2, 2);
+		if (!hnd2) {
+			fprintf(stderr, "ERROR: selabel_open - Could not obtain handle for %s:  %m\n", file2);
+			selabel_close(hnd1);
+			return EXIT_FAILURE;
+		}
+
+		result = selabel_cmp(hnd1, hnd2);
+
+		selabel_close(hnd2);
+		selabel_close(hnd1);
+
+		switch (result) {
+		case SELABEL_SUBSET:
+			printf("spec %s is a subset of spec %s\n", file1, file2);
+			break;
+		case SELABEL_EQUAL:
+			printf("spec %s is equal to spec %s\n", file1, file2);
+			break;
+		case SELABEL_SUPERSET:
+			printf("spec %s is a superset of spec %s\n", file1, file2);
+			break;
+		case SELABEL_INCOMPARABLE:
+			printf("spec %s is uncompareable to spec %s\n", file1, file2);
+			break;
+		default:
+			fprintf(stderr, "ERROR: selabel_cmp - Unexpected result %d\n", result);
+			return EXIT_FAILURE;
+		}
+
+		return EXIT_SUCCESS;
+	}
+}