patchfindutils - Patches: patch #4848, Patch - Support for SELinux

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #4848: Patch - Support for SELinux

Submitter:  James Youngman <jay>
Submitted:  Tue 31 Jan 2006 11:37:10 AM UTC
   
 
Category:  find enhancement Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  jay Originator Name: 
Open/Closed:  Closed Release:  None
Fixed Release:  4.5.6b

Jump to the original submission

Wed 31 Mar 2010 07:47:33 AM UTC, comment #6: 

Findutils 4.5.6b contains the relevant support, largely based on the Red Hat patch.   I'd like to thank Kamil Dudka for his patience.

James Youngman <jay>
Group administrator
Tue 30 Mar 2010 09:39:47 AM UTC, comment #5: 

I have now applied and pushed the change I emailed in December.

This change will be released in findutils 4.5.6.

James Youngman <jay>
Group administrator
Tue 24 Feb 2009 04:59:04 PM UTC, comment #4: 


> * It does not update the Texinfo documentation at all!

It does. The -context predicate is mentioned in 'info "Finding Files" "Mode Bits"' and the %Z printf conversion is mentioned in 'info "Actions" "Print File Information" "Format Directives" "Size Directives"' which is actually a wrong place. But I can't see any suitable node to move it. Should we create separate node for security context?

> * It makes --version emit SELINUX even if that feature is not availble.
> This is especially a problem because now there is presumably a significant
> installed base of RH-related machines that give misleading information.
> Since the gnulib implementation is a stub even if the compiled program is
> then run on a SELinux-enabled system, this is an unfortunate bug.  If a
> binary RPM package made with this patch has never been built on a machine
> lacking the selinux development libraries, this may be a bug without impact
> though.

available.
I've changed it to check for SELinux in run-time.

> * The costlookup[] initialisation sets pred_context to NeedsNothing, which
> will presumably lead the optimiser to prefer it to much cheaper tests (for
> example -type).  I would guess that NeedsAccessInfo is probably
> approximately the right cost (though I have not looked at the SELinux
> implementation).

I've looked quickly into getfilecon implementation. It uses the getxattr function to obtain file's context which uses getxattr syscall, at least at Fedora. The implementation is probably file system dependent, but NeedsAccessInfo seems to be good candidate.

> * parse_context leaves pred->est_success_rate at 1.0, which is on average
> an overestimate.

Well, changed to 0.01 - is this ok?

> There are also some minor issues which are just not a big deal (not
> patching the NEWS or ChangeLog files, spurious introduction of
> pred->args.scontext).

I've attempted to fix these minor issues.

Kamil Dudka <kdudka>
Sun 22 Feb 2009 03:51:05 PM UTC, comment #3: 

OK, the patch is a viable start - thanks for contributing it - but there are a number of problems:

  • It does not update the Texinfo documentation at all!


  • It makes --version emit SELINUX even if that feature is not availble.  This is especially a problem because now there is presumably a significant installed base of RH-related machines that give misleading information.  Since the gnulib implementation is a stub even if the compiled program is then run on a SELinux-enabled system, this is an unfortunate bug.  If a binary RPM package made with this patch has never been built on a machine lacking the selinux development libraries, this may be a bug without impact though. 


  • The costlookup[] initialisation sets pred_context to NeedsNothing, which will presumably lead the optimiser to prefer it to much cheaper tests (for example -type).  I would guess that NeedsAccessInfo is probably approximately the right cost (though I have not looked at the SELinux implementation).


  • parse_context leaves pred->est_success_rate at 1.0, which is on average an overestimate.


There are also some minor issues which are just not a big deal (not patching the NEWS or ChangeLog files, spurious introduction of pred->args.scontext).

Fortunately these problems only affect users who actually make use of -context (or look for SELINUX in the --version output).

I would be happy to apply an updated version of this patch if you'd care to make one.


James Youngman <jay>
Group administrator
Tue 24 Apr 2007 01:34:47 PM UTC, comment #2: 

There's no newer SELinux patch for findutils in Red Hat, so please take this one.

Vitezslav Crhonek <vcrhonek>
Sat 21 Apr 2007 01:59:33 PM UTC, comment #1: 

This patch is probably out of date now, but there will be a more recent one in whatever Red Hat are shipping now.

James Youngman <jay>
Group administrator
Tue 31 Jan 2006 11:37:10 AM UTC, original submission:  

From Miloslav Trmac


James Youngman <jay>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #17789:  0001-find-add-SELinux-support.patch added by kdudka (15KiB - application/octet-stream - up to date patch with improved documentation)
file #17522:  0001-find-add-SELinux-support.patch added by kdudka (15KiB - application/octet-stream - updated version of the patch)
file #17431:  0001-Add-SELinux-support.patch added by kdudka (14KiB - application/octet-stream - up to date version of the patch using selinux-h module from gnulib)
file #9503:  findutils-selinux.patch added by jay (15KiB - text/x-patch - Updated RH SELinux patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kdudka (Updated the item)
  • -email is unavailable- added by vcrhonek (Posted a comment)
  • -email is unavailable- added by jay (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-03-31 jay Open/ClosedOpen Closed
        Fixed ReleaseNone 4.5.6b
    2010-03-30 jay StatusNone Done
    2009-03-24 kdudka Attached File- Added 0001-find-add-SELinux-support.patch, #17789
    2009-02-24 kdudka Attached File- Added 0001-find-add-SELinux-support.patch, #17522
    2009-02-10 kdudka Attached File- Added 0001-Add-SELinux-support.patch, #17431
    2006-01-31 jay Attached File- Added findutils-selinux.patch, #5850
        Carbon-Copy- Added miloslavtrmac<mitr@redhat.com>

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code