sestatus: new SELinux applet (KaiGai Kohei <kaigai@ak.jp.nec.com>)

5 files changed, 234 insertions, 0 deletions

diff --git a/include/applets.h b/include/applets.h
index f188232c4..757fa4a25 100644
--- a/include/applets.h
+++ b/include/applets.h
@@ -300,6 +300,7 @@ USE_RX(APPLET(rx, _BB_DIR_USR_BIN, _BB_SUID_NEVER))
 USE_SED(APPLET(sed, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SELINUXENABLED(APPLET(selinuxenabled, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SEQ(APPLET_NOFORK(seq, seq, _BB_DIR_USR_BIN, _BB_SUID_NEVER, seq))
+USE_SESTATUS(APPLET(sestatus, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
 USE_SETARCH(APPLET(setarch, _BB_DIR_BIN, _BB_SUID_NEVER))
 USE_SETCONSOLE(APPLET(setconsole, _BB_DIR_SBIN, _BB_SUID_NEVER))
 USE_SETENFORCE(APPLET(setenforce, _BB_DIR_USR_SBIN, _BB_SUID_NEVER))
diff --git a/include/usage.h b/include/usage.h
index 3c8762ee1..5c03719d6 100644
--- a/include/usage.h
+++ b/include/usage.h
@@ -3121,6 +3121,12 @@ USE_FEATURE_RUN_PARTS_FANCY("\n	-l	Prints names of all matching files even when
        "        FIRST LAST\n" \
        "        FIRST INCREMENT LAST"
 
+#define sestatus_trivial_usage \
+       "[-vb]"
+#define sestatus_full_usage \
+       "-v      Verbose\n" \
+       "-b      Display current state of booleans"
+
 #define setconsole_trivial_usage \
        "[-r" USE_FEATURE_SETCONSOLE_LONG_OPTIONS("|--reset") "] [DEVICE]"
 #define setconsole_full_usage \
diff --git a/selinux/Config.in b/selinux/Config.in
index c9b48fb1b..f764056a2 100644
--- a/selinux/Config.in
+++ b/selinux/Config.in
@@ -112,5 +112,12 @@ config SETSEBOOL
           Enable support for change boolean.
           semanage and -P option is not supported yet.
 
+config SESTATUS
+        bool "sestatus"
+        default n
+        depends on SELINUX
+        help
+          Displays the status of SELinux.
+
 endmenu
 
diff --git a/selinux/Kbuild b/selinux/Kbuild
index ce353e066..d0c190ceb 100644
--- a/selinux/Kbuild
+++ b/selinux/Kbuild
@@ -17,3 +17,4 @@ lib-$(CONFIG_SETENFORCE)	+= setenforce.o
 lib-$(CONFIG_SETFILES)          += setfiles.o
 lib-$(CONFIG_RESTORECON)        += setfiles.o
 lib-$(CONFIG_SETSEBOOL)         += setsebool.o
+lib-$(CONFIG_SESTATUS)          += sestatus.o
diff --git a/selinux/sestatus.c b/selinux/sestatus.c
new file mode 100644
index 000000000..cc17b175b
--- /dev/null
+++ b/selinux/sestatus.c
@@ -0,0 +1,219 @@
+/*
+ * sestatus -- displays the status of SELinux
+ *
+ * Ported to busybox: KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * Copyright (C) KaiGai Kohei <kaigai@ak.jp.nec.com>
+ */
+
+#include "libbb.h"
+
+extern char *selinux_mnt;
+
+#define OPT_VERBOSE     (1 << 0)
+#define OPT_BOOLEAN     (1 << 1)
+
+#define COL_FMT         "%-31s "
+
+static void display_boolean(void)
+{
+        char **bools;
+        int i, active, pending, nbool;
+
+        if (security_get_boolean_names(&bools, &nbool) < 0)
+                return;
+
+        puts("\nPolicy booleans:");
+
+        for (i = 0; i < nbool; i++) {
+                active = security_get_boolean_active(bools[i]);
+                if (active < 0)
+                        goto skip;
+                pending = security_get_boolean_pending(bools[i]);
+                if (pending < 0)
+                        goto skip;
+                printf(COL_FMT "%s",
+                       bools[i], active == 0 ? "off" : "on");
+                if (active != pending)
+                        printf(" (%sactivate pending)", pending == 0 ? "in" : "");
+                bb_putchar('\n');
+ skip:
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        free(bools[i]);
+        }
+        if (ENABLE_FEATURE_CLEAN_UP)
+                free(bools);
+}
+
+static void read_config(char **pc, int npc, char **fc, int nfc)
+{
+        char buf[256];
+        FILE *fp;
+        int pc_ofs = 0, fc_ofs = 0, section = -1;
+
+        pc[0] = fc[0] = NULL;
+
+        fp = fopen("/etc/sestatus.conf", "rb");
+        if (fp == NULL)
+                return;
+
+        while (fgets(buf, sizeof(buf), fp) != NULL) {
+                int i, c;
+
+                /* kills comments */
+                for (i = 0; (c = buf[i]) != '\0'; i++) {
+                        if (c == '#') {
+                                buf[i] = '\0';
+                                break;
+                        }
+                }
+                trim(buf);
+
+                if (buf[0] == '\0')
+                        continue;
+
+                if (strcmp(buf, "[process]") == 0) {
+                        section = 1;
+                } else if (strcmp(buf, "[files]") == 0) {
+                        section = 2;
+                } else {
+                        if (section == 1 && pc_ofs < npc -1) {
+                                pc[pc_ofs++] = strdup(buf);
+                                pc[pc_ofs] = NULL;
+                        } else if (section == 2 && fc_ofs < nfc - 1) {
+                                fc[fc_ofs++] = strdup(buf);
+                                fc[fc_ofs] = NULL;
+                        }
+                }
+        }
+        fclose(fp);
+}
+
+static void display_verbose(void)
+{
+        security_context_t con, _con;
+        char *fc[50], *pc[50], *cterm;
+        pid_t *pidList;
+        int i;
+
+        read_config(pc, ARRAY_SIZE(pc), fc, ARRAY_SIZE(fc));
+
+        /* process contexts */
+        puts("\nProcess contexts:");
+
+        /* current context */
+        if (getcon(&con) == 0) {
+                printf(COL_FMT "%s\n", "Current context:", con);
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        freecon(con);
+        }
+        /* /sbin/init context */
+        if (getpidcon(1, &con) == 0) {
+                printf(COL_FMT "%s\n", "Init context:", con);
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        freecon(con);
+        }
+
+        /* [process] context */
+        for (i = 0; pc[i] != NULL; i++) {
+                pidList = find_pid_by_name(bb_basename(pc[i]));
+                if (pidList[0] > 0 && getpidcon(pidList[0], &con) == 0) {
+                        printf(COL_FMT "%s\n", pc[i], con);
+                        if (ENABLE_FEATURE_CLEAN_UP)
+                                freecon(con);
+                }
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        free(pidList);
+        }
+
+        /* files contexts */
+        puts("\nFile contexts:");
+
+        cterm = ttyname(0);
+        puts(cterm);
+        if (cterm && lgetfilecon(cterm, &con) >= 0) {
+                printf(COL_FMT "%s\n", "Controlling term:", con);
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        freecon(con);
+        }
+
+        for (i=0; fc[i] != NULL; i++) {
+                struct stat stbuf;
+
+                if (lgetfilecon(fc[i], &con) < 0)
+                        continue;
+                if (lstat(fc[i], &stbuf) == 0) {
+                        if (S_ISLNK(stbuf.st_mode)) {
+                                if (getfilecon(fc[i], &_con) >= 0) {
+                                        printf(COL_FMT "%s -> %s\n", fc[i], _con, con);
+                                        if (ENABLE_FEATURE_CLEAN_UP)
+                                                freecon(_con);
+                                }
+                        } else {
+                                printf(COL_FMT "%s\n", fc[i], con);
+                        }
+                }
+                if (ENABLE_FEATURE_CLEAN_UP)
+                        freecon(con);
+        }
+}
+
+int sestatus_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int sestatus_main(int argc, char **argv)
+{
+        unsigned opts;
+        const char *pol_path;
+        int rc;
+
+        opt_complementary = "?0";       /* no arguments are required. */
+        opts = getopt32(argv, "vb");
+
+        /* SELinux status: line */
+        rc = is_selinux_enabled();
+        if (rc < 0)
+                goto error;
+        printf(COL_FMT "%s\n", "SELinux status:",
+               rc == 1 ? "enabled" : "disabled");
+
+        /* SELinuxfs mount: line */
+        if (!selinux_mnt)
+                goto error;
+        printf(COL_FMT "%s\n", "SELinuxfs mount:",
+               selinux_mnt);
+
+        /* Current mode: line */
+        rc = security_getenforce();
+        if (rc < 0)
+                goto error;
+        printf(COL_FMT "%s\n", "Current mode:",
+               rc == 0 ? "permissive" : "enforcing");
+
+        /* Mode from config file: line */
+        if (selinux_getenforcemode(&rc) != 0)
+                goto error;
+        printf(COL_FMT "%s\n", "Mode from config file:",
+               rc < 0 ? "disabled" : (rc == 0 ? "permissive" : "enforcing"));
+
+        /* Policy version: line */
+        rc = security_policyvers();
+        if (rc < 0)
+                goto error;
+        printf(COL_FMT "%u\n", "Policy version:", rc);
+
+        /* Policy from config file: line */
+        pol_path = selinux_policy_root();
+        if (!pol_path)
+                goto error;
+        printf(COL_FMT "%s\n", "Policy from config file:",
+               bb_basename(pol_path));
+
+        if (opts & OPT_BOOLEAN)
+                display_boolean();
+        if (opts & OPT_VERBOSE)
+                display_verbose();
+
+        return 0;
+
+  error:
+        bb_perror_msg_and_die("libselinux returns unknown state");
+}