mkdir,mkfifo,mknod: with -Z, create SMACK security context

Enable creation of SMACK security context with -Z command-line switch
if SMACK is enabled.

* mkdir.c (main): Set process security context to given SMACK label.
* mkfifo.c (main): Likewise.
* mknod.c (main): Likewise.
* src/local.mk: link mk{dir, fifo, nod} with libsmack.
* NEWS: Mention the new feature.

Signed-off-by: Michael Demeter <michael.demeter@intel.com>
Conflicts:
	NEWS

Change-Id: Ib65d0891db7968dd7da06653e244579b4f943785

diff --git a/NEWS b/NEWS
index 0e90744..aa67348 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,74 @@
 GNU coreutils NEWS                                    -*- outline -*-
 
+<<<<<<< HEAD
+=======
+* Noteworthy changes in release ?.? (????-??-??) [?]
+
+** Bug fixes
+
+  install now removes the target file if the strip program failed for any
+  reason.  Before, that file was left behind, sometimes even with wrong
+  permissions.
+  [This bug was present in "the beginning".]
+
+  ln --relative now updates existing symlinks correctly.  Previously it based
+  the relative link on the dereferenced path of an existing link.
+  [This bug was introduced when --relative was added in coreutils-8.16.]
+
+  mkdir, mkfifo, and mknod now work better when creating a file in a directory
+  with a default ACL whose umask disagrees with the process's umask, on a
+  system such as GNU/Linux where directory ACL umasks override process umasks.
+  [bug introduced in coreutils-6.0]
+
+  od -wN with N larger than 64K on a system with 32-bit size_t would
+  print approximately 2*N bytes of extraneous padding.
+  [Bug introduced in coreutils-7.0]
+
+  tail --retry -f now waits for the files specified to appear.  Before, tail
+  would immediately exit when such a file is inaccessible during the initial
+  open.
+  [This bug was introduced when inotify support was added in coreutils-7.5]
+
+** New features
+
+  id and ls with -Z report the SMACK security context where available.
+  mkdir, mkfifo and mknod with -Z set the SMACK context where available.
+
+  join accepts a new option: --zero-terminated (-z). As with the sort,uniq
+  option of the same name, this makes join consume and produce NUL-terminated
+  lines rather than newline-terminated lines.
+
+  uniq accepts a new option: --group to print all items, while separating
+  unique groups with empty lines.
+
+  csplit accepts a new option: --suppressed-matched, to elide the lines
+  used to identify the split points.
+
+** Changes in behavior
+
+  stdbuf now requires at least one buffering mode option to be specified,
+  as per the documented interface.
+
+** Improvements
+
+  stat and tail work better with EFIVARFS, EXOFS, F2FS, SNFS and UBIFS.
+  stat -f --format=%T now reports the file system type, and tail -f now uses
+  inotify for files on those file systems, rather than the default (for unknown
+  file system types) of issuing a warning and reverting to polling.
+
+  shuf outputs subsets of large inputs much more efficiently.
+  Reservoir sampling is used to limit memory usage based on the number of
+  outputs, rather than the number of inputs.
+
+  split --line-bytes=SIZE, now only allocates memory as needed rather
+  than allocating SIZE bytes at program start.
+
+** Build-related
+
+  factor now builds on aarch64 based systems [bug introduced in coreutils-8.20]
+
+
+>>>>>>> 7d5976f... mkdir,mkfifo,mknod: with -Z, create SMACK security context
 * Noteworthy changes in release 8.21 (2013-02-14) [stable]
 
 ** New programs
@@ -8,9 +77,8 @@ GNU coreutils NEWS                                    -*- outline -*-
 
 ** New features
 
-  ls -Z and id -Z report the SMACK security context where available.
-  
-  id -Z reports the SMACK security context where available.
+  id and ls with -Z report the SMACK security context where available.
+  mkdir, mkfifo and mknod with -Z set the SMACK context where available.
 
   df now accepts the --output[=FIELD_LIST] option to define the list of columns
   to include in the output, or all available columns if the FIELD_LIST is

diff --git a/src/local.mk b/src/local.mk
index 95c0672..ba51f0b 100644 (file)
--- a/src/local.mk
+++ b/src/local.mk
@@ -232,8 +232,11 @@ src_id_LDADD += $(LIB_SMACK)
 src_ls_LDADD += $(LIB_SELINUX)
 src_ls_LDADD += $(LIB_SMACK)
 src_mkdir_LDADD += $(LIB_SELINUX)
+src_mkdir_LDADD += $(LIB_SMACK)
 src_mkfifo_LDADD += $(LIB_SELINUX)
+src_mkfifo_LDADD += $(LIB_SMACK)
 src_mknod_LDADD += $(LIB_SELINUX)
+src_mknod_LDADD += $(LIB_SMACK)
 src_runcon_LDADD += $(LIB_SELINUX)
 src_stat_LDADD += $(LIB_SELINUX)
 

diff --git a/src/mkdir.c b/src/mkdir.c
index a94f96e..3c44360 100644 (file)
--- a/src/mkdir.c
+++ b/src/mkdir.c
@@ -22,6 +22,10 @@
 #include <sys/types.h>
 #include <selinux/selinux.h>
 
+#ifdef HAVE_SMACK
+# include <sys/smack.h>
+#endif
+
 #include "system.h"
 #include "error.h"
 #include "mkdir-p.h"
@@ -140,6 +144,7 @@ main (int argc, char **argv)
   int optc;
   security_context_t scontext = NULL;
   struct mkdir_options options;
+  int ret = 0;
 
   options.make_ancestor_function = NULL;
   options.mode = S_IRWXUGO;
@@ -183,7 +188,17 @@ main (int argc, char **argv)
       usage (EXIT_FAILURE);
     }
 
-  if (scontext && setfscreatecon (scontext) < 0)
+  if (scontext)
+    {
+#ifdef HAVE_SMACK
+      if (smack_smackfs_path ())
+        ret = smack_set_label_for_self (scontext);
+      else
+#endif
+        ret = setfscreatecon (scontext);
+    }
+
+  if (ret < 0)
     error (EXIT_FAILURE, errno,
            _("failed to set default file creation context to %s"),
            quote (scontext));

diff --git a/src/mkfifo.c b/src/mkfifo.c
index 76291e5..731f6af 100644 (file)
--- a/src/mkfifo.c
+++ b/src/mkfifo.c
@@ -22,6 +22,10 @@
 #include <sys/types.h>
 #include <selinux/selinux.h>
 
+#ifdef HAVE_SMACK
+# include <sys/smack.h>
+#endif
+
 #include "system.h"
 #include "error.h"
 #include "modechange.h"
@@ -76,6 +80,7 @@ main (int argc, char **argv)
   int exit_status = EXIT_SUCCESS;
   int optc;
   security_context_t scontext = NULL;
+  int ret = 0;
 
   initialize_main (&argc, &argv);
   set_program_name (argv[0]);
@@ -108,7 +113,17 @@ main (int argc, char **argv)
       usage (EXIT_FAILURE);
     }
 
-  if (scontext && setfscreatecon (scontext) < 0)
+  if (scontext)
+    {
+#ifdef HAVE_SMACK
+      if (smack_smackfs_path ())
+        ret = smack_set_label_for_self (scontext);
+      else
+#endif
+        ret = setfscreatecon (scontext);
+    }
+
+  if (ret < 0)
     error (EXIT_FAILURE, errno,
            _("failed to set default file creation context to %s"),
            quote (scontext));

diff --git a/src/mknod.c b/src/mknod.c
index 7cfc708..d771c38 100644 (file)
--- a/src/mknod.c
+++ b/src/mknod.c
@@ -22,6 +22,10 @@
 #include <sys/types.h>
 #include <selinux/selinux.h>
 
+#ifdef HAVE_SMACK
+# include <sys/smack.h>
+#endif
+
 #include "system.h"
 #include "error.h"
 #include "modechange.h"
@@ -93,6 +97,7 @@ main (int argc, char **argv)
   int expected_operands;
   mode_t node_type;
   security_context_t scontext = NULL;
+  int ret = 0;
 
   initialize_main (&argc, &argv);
   set_program_name (argv[0]);
@@ -161,7 +166,17 @@ main (int argc, char **argv)
       usage (EXIT_FAILURE);
     }
 
-  if (scontext && setfscreatecon (scontext) < 0)
+  if (scontext)
+    {
+#ifdef HAVE_SMACK
+      if (smack_smackfs_path ())
+        ret = smack_set_label_for_self (scontext);
+      else
+#endif
+        ret = setfscreatecon (scontext);
+    }
+
+  if (ret < 0)
     error (EXIT_FAILURE, errno,
            _("failed to set default file creation context to %s"),
            quote (scontext));