Jira (PUP-10962) Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

[Tobias Urdin (Jira)]

Tobias Urdin created an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3) Issue Type: Task Assignee: Unassigned Created: 2021/03/11 2:12 AM Priority: Normal Reporter: Tobias Urdin Puppet::Util::SElinux uses the deprecated matchpathcon(3) exposed by the C bindings for SELinux.   This should be changed to instead open a handle with selabel_open, doing the lookup with selabel_lookup then closing the handle with selabel_close.   Add Comment

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)

[Tobias Urdin (Jira)]

Tobias Urdin updated an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Tobias Urdin

Puppet::Util::SElinux uses the deprecated matchpathcon(3) exposed by the C bindings for SELinux.   This should be changed to instead open a handle with selabel_open, doing the lookup with selabel_lookup then closing the handle with selabel_close.

This has been available since mid 2015 when it was introduced in [1] just need to verify it's included in all new major versions of supported operating systems.  [1] [https://github.com/SELinuxProject/selinux/commit/e7f970ffd1a8dbb26051405719a2288d34e856f6]

Add Comment

[Tobias Urdin (Jira)]

Tobias Urdin commented on PUP-10962

Re: Migrate SELinux util from matchpathcon(3) to selabel_lookup(3) I won't have time to push a patch right now, but it's a simple fix in https://github.com/puppetlabs/puppet/blob/main/lib/puppet/util/selinux.rb#L55-L59   Replacing the first snippet below with the second one and fixing testing. retval = Selinux.matchpathcon(file, mode) if retval == -1   return nil end retval[1] begin   hnd = Selinux.selabel_open(SELABEL_CTX_FILE, nil, 0)   retval = Selinux.selabel_lookup(hnd, nil, file, mode)   if retval == -1     return nil   end   retval[1] rescue   nil ensure   Selinux.selabel_close(hnd) if hnd end

Add Comment

[Ciprian Badescu (Jira)]

Ciprian Badescu updated an issue

Puppet / PUP-10962

Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Ciprian Badescu Issue Type: Task Improvement

Add Comment

This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97)

[Ciprian Badescu (Jira)]

Ciprian Badescu updated an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Ciprian Badescu Labels: community

Add Comment

[Ciprian Badescu (Jira)]

Ciprian Badescu updated an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Ciprian Badescu Team: Night's Watch

Add Comment

[Ciprian Badescu (Jira)]

Ciprian Badescu updated an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Ciprian Badescu Epic Link: PUP-7384

Add Comment

[Ciprian Badescu (Jira)]

[Ciprian Badescu (Jira)]

Ciprian Badescu updated an issue

Puppet / PUP-10962 Migrate SELinux util from matchpathcon(3) to selabel_lookup(3)

Change By: Ciprian Badescu Epic Link: PUP-11132

Add Comment