Skip to content

Commit 51c6c0a

Browse files
author
Mrunal Patel
authored
Merge pull request #38 from rhatdan/socketlabel
Add label.SetSocketCreate method
2 parents 6ba084d + e321a5d commit 51c6c0a

File tree

8 files changed

+254
-4
lines changed

8 files changed

+254
-4
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ endif
88
.PHONY: test
99
test: check-gopath
1010
go test -timeout 3m -tags "${BUILDTAGS}" ${TESTFLAGS} -v ./...
11+
go test -timeout 3m ${TESTFLAGS} -v ./...
1112

1213
.PHONY:
1314
lint:

‎go-selinux/label/label.go‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ func InitLabels(options []string) (string, string, error) {
99
return "", "", nil
1010
}
1111

12-
func GetROMountLabel() string {
12+
func ROMountLabel() string {
1313
return ""
1414
}
1515

@@ -25,7 +25,19 @@ func SetProcessLabel(processLabel string) error {
2525
return nil
2626
}
2727

28-
func GetFileLabel(path string) (string, error) {
28+
func ProcessLabel() (string, error) {
29+
return "", nil
30+
}
31+
32+
func SetSocketLabel(processLabel string) error {
33+
return nil
34+
}
35+
36+
func SocketLabel() (string, error) {
37+
return "", nil
38+
}
39+
40+
func FileLabel(path string) (string, error) {
2941
return "", nil
3042
}
3143

@@ -41,7 +53,7 @@ func Relabel(path string, fileLabel string, shared bool) error {
4153
return nil
4254
}
4355

44-
func GetPidLabel(pid int) (string, error) {
56+
func PidLabel(pid int) (string, error) {
4557
return "", nil
4658
}
4759

‎go-selinux/label/label_selinux.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,25 @@ func SetProcessLabel(processLabel string) error {
9595
return selinux.SetExecLabel(processLabel)
9696
}
9797

98+
// SetSocketLabel takes a process label and tells the kernel to assign the
99+
// label to the next socket that gets created
100+
func SetSocketLabel(processLabel string) error {
101+
return selinux.SetSocketLabel(processLabel)
102+
}
103+
104+
// SocketLabel retrieves the current default socket label setting
105+
func SocketLabel() (string, error) {
106+
return selinux.SocketLabel()
107+
}
108+
98109
// ProcessLabel returns the process label that the kernel will assign
99110
// to the next program executed by the current process. If "" is returned
100111
// this indicates that the default labeling will happen for the process.
101112
func ProcessLabel() (string, error) {
102113
return selinux.ExecLabel()
103114
}
104115

105-
// GetFileLabel returns the label for specified path
116+
// FileLabel returns the label for specified path
106117
func FileLabel(path string) (string, error) {
107118
return selinux.FileLabel(path)
108119
}

‎go-selinux/label/label_selinux_stub_test.go‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
// +build !selinux !linux
2+
3+
package label
4+
5+
import (
6+
"os"
7+
"testing"
8+
)
9+
10+
func TestInit(t *testing.T) {
11+
var testNull []string
12+
_, _, err := InitLabels(testNull)
13+
if err != nil {
14+
t.Log("InitLabels Failed")
15+
t.Fatal(err)
16+
}
17+
testDisabled := []string{"disable"}
18+
roMountLabel := ROMountLabel()
19+
if roMountLabel != "" {
20+
t.Errorf("ROMountLabel Failed")
21+
}
22+
plabel, _, err := InitLabels(testDisabled)
23+
if err != nil {
24+
t.Log("InitLabels Disabled Failed")
25+
t.Fatal(err)
26+
}
27+
if plabel != "" {
28+
t.Log("InitLabels Disabled Failed")
29+
t.FailNow()
30+
}
31+
testUser := []string{"user:user_u", "role:user_r", "type:user_t", "level:s0:c1,c15"}
32+
plabel, _, err = InitLabels(testUser)
33+
if err != nil {
34+
t.Log("InitLabels User Failed")
35+
t.Fatal(err)
36+
}
37+
}
38+
39+
func TestRelabel(t *testing.T) {
40+
testdir := "/tmp/test"
41+
if err := os.Mkdir(testdir, 0755); err != nil {
42+
t.Fatal(err)
43+
}
44+
defer os.RemoveAll(testdir)
45+
label := "system_u:object_r:container_file_t:s0:c1,c2"
46+
if err := Relabel("/etc", label, false); err != nil {
47+
t.Fatalf("Relabel /etc succeeded")
48+
}
49+
}
50+
51+
func TestSocketLabel(t *testing.T) {
52+
label := "system_u:object_r:container_t:s0:c1,c2"
53+
if err := SetSocketLabel(label); err != nil {
54+
t.Fatal(err)
55+
}
56+
if _, err := SocketLabel(); err != nil {
57+
t.Fatal(err)
58+
}
59+
}
60+
61+
func TestProcessLabel(t *testing.T) {
62+
label := "system_u:object_r:container_t:s0:c1,c2"
63+
if err := SetProcessLabel(label); err != nil {
64+
t.Fatal(err)
65+
}
66+
if _, err := ProcessLabel(); err != nil {
67+
t.Fatal(err)
68+
}
69+
}
70+
71+
func CheckLabelCompile(t *testing.T) {
72+
if _, _, err := GenLabels(""); err != nil {
73+
t.Fatal(err)
74+
}
75+
if test := FormatMountLabel("", ""); test != "" {
76+
t.Fatal("Format failed")
77+
}
78+
79+
if test := FormatMountLabel("", ""); test != "" {
80+
t.Fatal("Format failed")
81+
}
82+
83+
if _, err := FileLabel("/etc"); err != nil {
84+
t.Fatal(err)
85+
}
86+
87+
if err := SetFileLabel("/etc", "foobar"); err != nil {
88+
t.Fatal(err)
89+
}
90+
91+
if err := SetFileCreateLabel("foobar"); err != nil {
92+
t.Fatal(err)
93+
}
94+
95+
if _, err := PidLabel(0); err != nil {
96+
t.Fatal(err)
97+
}
98+
99+
ClearLabels()
100+
101+
if err := ReserveLabel("foobar"); err != nil {
102+
t.Fatal(err)
103+
}
104+
105+
if err := ReleaseLabel("foobar"); err != nil {
106+
t.Fatal(err)
107+
}
108+
109+
DupSecOpt("foobar")
110+
DisableSecOpt()
111+
112+
if err := Validate("foobar"); err != nil {
113+
t.Fatal(err)
114+
}
115+
if relabel := RelabelNeeded("foobar"); relabel {
116+
t.Fatal("Relabel failed")
117+
}
118+
if shared := IsShared("foobar"); shared {
119+
t.Fatal("isshared failed")
120+
}
121+
}

‎go-selinux/label/label_selinux_test.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,3 +159,20 @@ func TestSELinuxNoLevel(t *testing.T) {
159159
t.Errorf("NewContaxt and con.Get() Failed on non mls label")
160160
}
161161
}
162+
163+
func TestSocketLabel(t *testing.T) {
164+
if !selinux.GetEnabled() {
165+
return
166+
}
167+
label := "system_u:object_r:container_t:s0:c1,c2"
168+
if err := selinux.SetSocketLabel(label); err != nil {
169+
t.Fatal(err)
170+
}
171+
nlabel, err := selinux.SocketLabel()
172+
if err != nil {
173+
t.Fatal(err)
174+
}
175+
if label != nlabel {
176+
t.Errorf("SocketLabel %s != %s", nlabel, label)
177+
}
178+
}

‎go-selinux/selinux_linux.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,17 @@ func SetExecLabel(label string) error {
385385
return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), label)
386386
}
387387

388+
// SetSocketLabel takes a process label and tells the kernel to assign the
389+
// label to the next socket that gets created
390+
func SetSocketLabel(label string) error {
391+
return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/sockcreate", syscall.Gettid()), label)
392+
}
393+
394+
// SocketLabel retrieves the current socket label setting
395+
func SocketLabel() (string, error) {
396+
return readCon(fmt.Sprintf("/proc/self/task/%d/attr/sockcreate", syscall.Gettid()))
397+
}
398+
388399
// Get returns the Context as a string
389400
func (c Context) Get() string {
390401
if c["level"] != "" {

‎go-selinux/selinux_stub.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,19 @@ func SetExecLabel(label string) error {
9696
return nil
9797
}
9898

99+
/*
100+
SetSocketLabel sets the SELinux label that the kernel will use for any programs
101+
that are executed by the current process thread, or an error.
102+
*/
103+
func SetSocketLabel(label string) error {
104+
return nil
105+
}
106+
107+
// SocketLabel retrieves the current socket label setting
108+
func SocketLabel() (string, error) {
109+
return "", nil
110+
}
111+
99112
// Get returns the Context as a string
100113
func (c Context) Get() string {
101114
return ""

‎go-selinux/selinux_stub_test.go‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,68 @@ func TestSELinux(t *testing.T) {
1010
if GetEnabled() {
1111
t.Fatal("SELinux enabled with build-tag !selinux.")
1212
}
13+
14+
if _, err := FileLabel("/etc"); err != nil {
15+
t.Fatal(err)
16+
}
17+
18+
if err := SetFileLabel("/etc", "foobar"); err != nil {
19+
t.Fatal(err)
20+
}
21+
22+
if err := SetFSCreateLabel("foobar"); err != nil {
23+
t.Fatal(err)
24+
}
25+
26+
if _, err := FSCreateLabel(); err != nil {
27+
t.Fatal(err)
28+
}
29+
if _, err := CurrentLabel(); err != nil {
30+
t.Fatal(err)
31+
}
32+
33+
if _, err := PidLabel(0); err != nil {
34+
t.Fatal(err)
35+
}
36+
37+
ClearLabels()
38+
39+
ReserveLabel("foobar")
40+
ReleaseLabel("foobar")
41+
DupSecOpt("foobar")
42+
DisableSecOpt()
43+
SetDisabled()
44+
if enabled := GetEnabled(); enabled {
45+
t.Fatal("Should not be enabled")
46+
}
47+
if err := SetExecLabel("foobar"); err != nil {
48+
t.Fatal(err)
49+
}
50+
if _, err := ExecLabel(); err != nil {
51+
t.Fatal(err)
52+
}
53+
if _, err := CanonicalizeContext("foobar"); err != nil {
54+
t.Fatal(err)
55+
}
56+
if err := SetSocketLabel("foobar"); err != nil {
57+
t.Fatal(err)
58+
}
59+
if _, err := SocketLabel(); err != nil {
60+
t.Fatal(err)
61+
}
62+
con := NewContext("foobar")
63+
con.Get()
64+
if err := SetEnforceMode(1); err != nil {
65+
t.Fatal(err)
66+
}
67+
DefaultEnforceMode()
68+
EnforceMode()
69+
ROFileLabel()
70+
ContainerLabels()
71+
if err := SecurityCheckContext("foobar"); err != nil {
72+
t.Fatal(err)
73+
}
74+
if _, err := CopyLevel("foo", "bar"); err != nil {
75+
t.Fatal(err)
76+
}
1377
}

0 commit comments

Comments
 (0)