Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRFC: changing the "+" in ls -l output to be "." or "+"
From: Jim Meyering <jim_at_meyering.net>
Date: Wed, 02 Apr 2008 22:33:49 +0200
No one spoke up, so here's code, for discussion's sake.
I've tested it only lightly.
Here's sample output, running on an SELinux system: $ src/ls -ldgo [ac]* -rw-r--r--. 1 42625 2008-04-02 19:31 aclocal.m4 drwxr-xr-x. 2 4096 2008-04-02 19:31 autom4te.cache -rw-r--r--. 1 1597 2008-03-21 16:35 cfg.mk -rw-r--r--. 1 1417195 2008-04-02 19:33 config.log -rwxr-xr-x. 1 71225 2008-04-02 19:33 config.status -rwxr-xr-x. 1 1846424 2008-04-02 19:31 configure -rw-r--r--. 1 12014 2008-03-25 23:55 configure.ac ------------------------------------ Use '.' (not +) as SELinux-only alternate access flag in ls -l output * src/ls.c (gobble_file) [long_format]: Map SELinux-only to '.', any other nonempty combination of MAC and ACL to '+', and all else to the usual ' '. * tests/misc/selinux: Adapt: expect '.', not '+'. * NEWS: TBD --- src/ls.c | 25 +++++++++++++++++++------tests/misc/selinux | 4 ++-- 2 files changed, 21 insertions(+), 8 deletions(-)
diff --git a/src/ls.c b/src/ls.c
C_LINK, C_SOCK, C_FILE, C_DIR \
+enum acl_type + { + ACL_T_NONE, + ACL_T_SELINUX_ONLY, + ACL_T_YES + };
struct fileinfo
/* For long listings, true if the file has an access control list, or an SELinux security context. */- bool have_acl; + enum acl_type acl_type; }; #define LEN_STR_PAIR(s) sizeof (s) - 1, s @@ -2671,6 +2677,7 @@ gobble_file (char const *name, enum filetype type, ino_t inode, if (format == long_format || print_scontext) { + bool have_selinux = false; bool have_acl = false; int attr_len = (do_deref ? getfilecon (absolute_name, &f->scontext) @@ -2689,7 +2696,7 @@ gobble_file (char const *name, enum filetype type, ino_t inode, } if (err == 0) - have_acl = ! STREQ ("unlabeled", f->scontext); + have_selinux = ! STREQ ("unlabeled", f->scontext); else { f->scontext = UNKNOWN_SECURITY_CONTEXT; @@ -2702,15 +2709,19 @@ gobble_file (char const *name, enum filetype type, ino_t inode, err = 0; } - if (err == 0 && ! have_acl && format == long_format) + if (err == 0 && format == long_format) { int n = file_has_acl (absolute_name, &f->stat); err = (n < 0); have_acl = (0 < n); } - f->have_acl = have_acl; - any_has_acl |= have_acl; + f->acl_type = (!have_selinux && !have_acl + ? ACL_T_NONE + : (have_selinux && !have_acl + ? ACL_T_SELINUX_ONLY + : ACL_T_YES)); + any_has_acl |= f->acl_type != ACL_T_NONE; if (err) error (0, errno, "%s", quotearg_colon (absolute_name)); @@ -3430,7 +3441,9 @@ print_long_format (const struct fileinfo *f) } if (! any_has_acl) modebuf[10] = '\0'; - else if (f->have_acl) + else if (f->acl_type == ACL_T_SELINUX_ONLY) + modebuf[10] = '.'; + else if (f->acl_type == ACL_T_YES) modebuf[10] = '+';
switch (time_type)
c=`stat --printf %C $i`; test x$c = x$ctx || fail=1 done -# ensure that ls -l output includes the "+". -c=`ls -l f|cut -c11`; test "$c" = + || fail=1 +# ensure that ls -l output includes the ".". +c=`ls -l f|cut -c11`; test "$c" = . || fail=1 # Copy each to a new directory and ensure that context is preserved. cp -r --preserve=all d f p s1 || fail=1 -- 1.5.5.rc2.26.g7bba -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Wed 2 Apr 2008 - 16:40:47 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |