Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

selinux: write xattr related codes. #2825

Merged
merged 1 commit into from
Jul 9, 2024
+299 −99
Merged

selinux: write xattr related codes. #2825

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
122 changes: 122 additions & 0 deletions experiment/selinux/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions experiment/selinux/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,6 @@ keywords = ["youki", "container", "selinux"]

[dependencies]
nix = { version = "0.29.0", features = ["process", "fs"] }
rustix = { version = "0.38.34", features = ["fs"] }
tempfile = "3.10.1"
thiserror = "1.0.61"
2 changes: 1 addition & 1 deletion experiment/selinux/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
pub mod selinux;
pub mod xattr;
pub mod xattrs;
75 changes: 42 additions & 33 deletions experiment/selinux/src/selinux.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
use crate::xattr::*;
use nix::unistd::gettid;
use nix::sys::statfs;
use crate::xattrs::*;
use nix::errno::Errno;
use std::path::{Path, PathBuf};
use nix::sys::statfs;
use nix::unistd::gettid;
use std::fs::File;
use std::io::Read;
use std::os::fd::{AsFd, AsRawFd};
use std::path::{Path, PathBuf};
use std::sync::atomic::{AtomicBool, Ordering};

const XATTR_NAME_SELINUX: &str = "security.selinux";
Expand All @@ -26,7 +26,7 @@ pub enum SELinuxError {
#[error("Failed to call read_con_fd for SELinux: {0}")]
ReadConFd(String),
#[error("Failed to call read_con for SELinux: {0}")]
ReadCon(String),
ReadCon(String),
}

pub struct SELinux {
Expand Down Expand Up @@ -75,14 +75,15 @@ impl SELinux {
}

loop {
match set_xattr(fpath, XATTR_NAME_SELINUX, label.as_bytes(), 0) {
match fpath.set_xattr(XATTR_NAME_SELINUX, label.as_bytes()) {
Ok(_) => break,
// TODO: This line will be fixed after implementing set_xattr.
Err(EINTR) => continue,
// When a system call is interrupted by a signal, it needs to be retried.
Err(XattrError::EINTR(_)) => continue,
Err(e) => {
return Err(SELinuxError::SetFileLabel(
format!("set_xattr failed: {}", e),
));
return Err(SELinuxError::SetFileLabel(format!(
"set_xattr failed: {}",
e
)));
}
}
}
Expand All @@ -98,12 +99,15 @@ impl SELinux {
}

loop {
match lset_xattr(fpath, XATTR_NAME_SELINUX, label.as_bytes(), 0) {
match fpath.lset_xattr(XATTR_NAME_SELINUX, label.as_bytes()) {
Ok(_) => break,
// TODO: This line will be fixed after implementing lset_xattr.
Err(EINTR) => continue,
// When a system call is interrupted by a signal, it needs to be retried.
Err(XattrError::EINTR(_)) => continue,
Err(e) => {
return Err(SELinuxError::LSetFileLabel(format!("lset_xattr failed: {}", e)));
return Err(SELinuxError::LSetFileLabel(format!(
"lset_xattr failed: {}",
e
)));
}
}
}
Expand All @@ -117,7 +121,8 @@ impl SELinux {
if !fpath.exists() {
return Err(SELinuxError::FileLabel(ERR_EMPTY_PATH.to_string()));
}
get_xattr(fpath, XATTR_NAME_SELINUX)
fpath
.get_xattr(XATTR_NAME_SELINUX)
.map_err(|e| SELinuxError::FileLabel(e.to_string()))
}

Expand All @@ -128,7 +133,8 @@ impl SELinux {
if !fpath.exists() {
return Err(SELinuxError::LFileLabel(ERR_EMPTY_PATH.to_string()));
}
lget_xattr(fpath, XATTR_NAME_SELINUX)
fpath
.lget_xattr(XATTR_NAME_SELINUX)
.map_err(|e| SELinuxError::LFileLabel(e.to_string()))
}

Expand Down Expand Up @@ -218,7 +224,7 @@ impl SELinux {
}

// function similar with clearLabels in go-selinux repo.
// clear_labels clears all reserved labels.
// clear_labels clears all reserved labels.
pub fn clear_labels() {
unimplemented!("not implemented yet")
}
Expand Down Expand Up @@ -305,12 +311,17 @@ impl SELinux {
match statfs::fstatfs(file.as_fd()) {
Ok(stat) if stat.filesystem_type() == statfs::PROC_SUPER_MAGIC => break,
Ok(_) => {
return Err(SELinuxError::IsProcHandle(format!("file {} is not on procfs", file.as_raw_fd())
));
},
return Err(SELinuxError::IsProcHandle(format!(
"file {} is not on procfs",
file.as_raw_fd()
)));
}
Err(Errno::EINTR) => continue,
Err(err) => {
return Err(SELinuxError::IsProcHandle(format!("fstatfs failed: {}", err)))
return Err(SELinuxError::IsProcHandle(format!(
"fstatfs failed: {}",
err
)))
}
}
}
Expand All @@ -322,7 +333,7 @@ impl SELinux {
let mut data = String::new();
file.read_to_string(&mut data)
.map_err(|e| SELinuxError::ReadConFd(e.to_string()))?;

// Remove null bytes on the end of a file.
let trimmed_data = data.trim_end_matches(char::from(0));
Ok(trimmed_data.to_string())
Expand Down Expand Up @@ -365,8 +376,8 @@ impl SELinux {
mod tests {
use crate::selinux::*;
use std::fs::{self, File};
use std::path::Path;
use std::io::Write;
use std::path::Path;

fn create_temp_file(content: &[u8], file_name: &str) {
let path = Path::new(file_name);
Expand All @@ -383,10 +394,7 @@ mod tests {
for (i, src) in src_array.iter().enumerate() {
let mount_label = mount_label_array[i];
let expected = expected_array[i];
assert_eq!(
SELinux::format_mount_label(src, mount_label),
expected
);
assert_eq!(SELinux::format_mount_label(src, mount_label), expected);
}
}

Expand All @@ -405,11 +413,12 @@ mod tests {
expected
);
}
}
}

#[test]
fn test_read_con_fd() {
let content_array: Vec<&[u8]> = vec![b"Hello, world\0", b"Hello, world\0\0\0", b"Hello,\0world"];
let content_array: Vec<&[u8]> =
vec![b"Hello, world\0", b"Hello, world\0\0\0", b"Hello,\0world"];
let expected_array = ["Hello, world", "Hello, world", "Hello,\0world"];
let file_name = "test.txt";
for (i, content) in content_array.iter().enumerate() {
Expand All @@ -435,12 +444,12 @@ mod tests {

// Test with not having "/proc/thread-self/attr" path by setting HAVE_THREAD_SELF as false
selinux.init_done.store(true, Ordering::SeqCst);
selinux.have_thread_self.store(false, Ordering::SeqCst);
selinux.have_thread_self.store(false, Ordering::SeqCst);
let thread_id = gettid();
let expected_name = &format!("/proc/self/task/{}/attr/{}", thread_id, attr);
let expected_path = Path::new(expected_name);
let actual_path = selinux.attr_path(attr);
assert_eq!(expected_path, actual_path);
assert_eq!(expected_path, actual_path);
}

#[test]
Expand All @@ -462,7 +471,7 @@ mod tests {
if expected_ok {
assert!(result.is_ok(), "Expected Ok, but got Err: {:?}", result);
} else {
assert!(result.is_err(), "Expected Err, but got Ok");
assert!(result.is_err(), "Expected Err, but got Ok");
}
}
}
Expand Down
Loading
Loading