Hi!
On Thu, 2015-05-21 at 19:11:22 +0200, Laurent Bigonville wrote:
> Package: dpkg
> Version: 1.18.0
> Severity: important
> User: [email protected]
> Usertags: selinux
> When the dbus package is installed, it seems that the SELinux label for
> /usr/lib/dbus-1.0/dbus-daemon-launch-helper is not properly set.
Ah, I meant to ask for testing that specific change in 1.18.0, but it
seems I forgot, thanks for doing that and tracking the problem down!
> Investigating a bit further it seem that dpkg_selabel_set_context() is
> immediately exiting the function in the following test:
>
> if ((mode & S_IFMT) == 0)
> return;
>
> When installing the dbus package, gdb shows:
>
> Breakpoint 1, dpkg_selabel_set_context (matchpath=0x2ad6500
> "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", path=0x29d38b0
> "/usr/lib/dbus-1.0/dbus-daemon-launch-helper.dpkg-new", mode=2540)
>
> The file is setuid with the following dpkg-statoverride call:
>
> dpkg-statoverride --update --add root "messagebus" 4754
> "/usr/lib/dbus-1.0/dbus-daemon-launch-helper"
>
> So it seems that the "mode" for files that have a statoverride entry is not
> containing the type of the file, but only the permissions. I can confirm that
> if I'm removing the override and reinstalling the package. I then get:
>
> Breakpoint 1, dpkg_selabel_set_context (matchpath=0x24a1500
> "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", path=0x239e8b0
> "/usr/lib/dbus-1.0/dbus-daemon-launch-helper.dpkg-new", mode=33261)
>
> I guess that the proper fix is to set the file type in the "mode" variable in
> all situation.
Right, could you try the attached patch to see if it works on a
SE Linux system?
Thanks,
Guillem
diff --git a/src/statcmd.c b/src/statcmd.c
index fd93c28..011bc49 100644
--- a/src/statcmd.c
+++ b/src/statcmd.c
@@ -163,7 +163,7 @@ statdb_node_apply(const char *filename, struct file_stat *filestat)
{
if (chown(filename, filestat->uid, filestat->gid) < 0)
ohshite(_("error setting ownership of '%.255s'"), filename);
- if (chmod(filename, filestat->mode))
+ if (chmod(filename, filestat->mode & ~S_IFMT))
ohshite(_("error setting permissions of '%.255s'"), filename);
dpkg_selabel_load();
@@ -197,7 +197,7 @@ statdb_node_print(FILE *out, struct filenamenode *file)
else
fprintf(out, "#%d ", filestat->gid);
- fprintf(out, "%o %s\n", filestat->mode, file->name);
+ fprintf(out, "%o %s\n", filestat->mode & ~S_IFMT, file->name);
}
static void
@@ -261,11 +261,13 @@ statoverride_add(const char *const *argv)
if (opt_update) {
struct stat st;
- if (stat(filename, &st) == 0)
+ if (stat(filename, &st) == 0) {
+ (*filestat)->mode |= st.st_mode & S_IFMT;
statdb_node_apply(filename, *filestat);
- else if (opt_verbose)
+ } else if (opt_verbose) {
warning(_("--update given but %s does not exist"),
filename);
+ }
}
statdb_write();
