* src/copy.c (copy_internal): Use the global process context to set the context of existing directories before they're populated. This is more consistent with the new directory case, and fixes a bug for existing directories where we erroneously set the context to the last copied descendent, rather than to that of the source directory itself. * tests/cp/cp-a-selinux.sh: Add a test for this case. * NEWS: Mention the fix. * THANKS.in: Add reporter Michal Trunecka. --- NEWS | 7 +++++++ THANKS.in | 1 + src/copy.c | 13 ++++++++++++- tests/cp/cp-a-selinux.sh | 15 +++++++++++++++ 4 files changed, 35 insertions(+), 1 deletions(-)
diff --git a/NEWS b/NEWS index 66884db..0d81f45 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,13 @@ GNU coreutils NEWS -*- outline -*- * Noteworthy changes in release ?.? (????-??-??) [?] +** Bug fixes + + cp -a again sets the correct SELinux context for existing directories in + the destination. Previously it set the context of an existing directory + to that of its last copied descendent. + [bug introduced in coreutils-8.22] + * Noteworthy changes in release 8.22 (2013-12-13) [stable] diff --git a/THANKS.in b/THANKS.in index 6588376..5b3e96e 100644 --- a/THANKS.in +++ b/THANKS.in @@ -441,6 +441,7 @@ Michael Veksler [email protected] Michail Litvak [email protected] Michal Politowski [email protected] Michal Svec [email protected] +Michal Trunecka [email protected] Michel Robitaille [email protected] Michiel Bacchiani [email protected] Mike Castle [email protected] diff --git a/src/copy.c b/src/copy.c index 557d37b..3e4cbff 100644 --- a/src/copy.c +++ b/src/copy.c @@ -2408,6 +2408,17 @@ copy_internal (char const *src_name, char const *dst_name, else { omitted_permissions = 0; + + /* For directories, the process global context could be reset for + descendents, so use it to set the context for existing dirs here. + This will also give earlier indication of failure to set ctx. */ + if (x->set_security_context || x->preserve_security_context) + if (! set_file_security_ctx (dst_name, x->preserve_security_context, + false, x)) + { + if (x->require_preserve_context) + goto un_backup; + } } /* Decide whether to copy the contents of the directory. */ @@ -2598,7 +2609,7 @@ copy_internal (char const *src_name, char const *dst_name, /* With -Z or --preserve=context, set the context for existing files. Note this is done already for copy_reg() for reasons described therein. */ - if (!new_dst && !x->copy_as_regular + if (!new_dst && !x->copy_as_regular && !S_ISDIR (src_mode) && (x->set_security_context || x->preserve_security_context)) { if (! set_file_security_ctx (dst_name, x->preserve_security_context, diff --git a/tests/cp/cp-a-selinux.sh b/tests/cp/cp-a-selinux.sh index 79b1c0a..02e9b63 100755 --- a/tests/cp/cp-a-selinux.sh +++ b/tests/cp/cp-a-selinux.sh @@ -41,6 +41,21 @@ test -s err && fail=1 #there must be no stderr output for -a ls -Z e | grep $ctx || fail=1 ls -Z f | grep $ctx || fail=1 +# Check handling of existing dirs which requires specific handling +# due to recursion, and was handled incorrectly in coreutils-8.22 +mkdir -p backup/existing_dir/ || framework_failure_ +ls -Zd backup/existing_dir | grep $ctx && framework_failure_ +touch backup/existing_dir/file || framework_failure_ +chcon $ctx backup/existing_dir/file || framework_failure_ +# Set the dir context to ensure it is reset +mkdir -p --context="$ctx" restore/existing_dir || framework_failure_ +# Set the permissions of the source to show they're reset too +chmod o+rw restore/existing_dir +# Copy and ensure existing directories updated +cp -a backup/. restore/ +ls -Zd restore/existing_dir | grep $ctx && + { ls -lZd restore/existing_dir; fail=1; } + # Check restorecon (-Z) functionality for file and directory get_selinux_type() { ls -Zd "$1" | sed -n 's/.*:\(.*_t\):.*/\1/p'; } # Also make a dir with our known context -- 1.7.7.6
