src/chcon.c

   1 /* chcon -- change security context of files
   2    Copyright (C) 2005-2015 Free Software Foundation, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  16
  17 #include <config.h>
  18 #include <stdio.h>
  19 #include <sys/types.h>
  20 #include <getopt.h>
  21
  22 #include "system.h"
  23 #include "dev-ino.h"
  24 #include "error.h"
  25 #include "ignore-value.h"
  26 #include "quote.h"
  27 #include "quotearg.h"
  28 #include "root-dev-ino.h"
  29 #include "selinux-at.h"
  30 #include "xfts.h"
  31
  32 /* The official name of this program (e.g., no 'g' prefix).  */
  33 #define PROGRAM_NAME "chcon"
  34
  35 #define AUTHORS \
  36   proper_name ("Russell Coker"), \
  37   proper_name ("Jim Meyering")
  38
  39 /* If nonzero, and the systems has support for it, change the context
  40    of symbolic links rather than any files they point to.  */
  41 static bool affect_symlink_referent;
  42
  43 /* If true, change the modes of directories recursively. */
  44 static bool recurse;
  45
  46 /* Level of verbosity. */
  47 static bool verbose;
  48
  49 /* Pointer to the device and inode numbers of '/', when --recursive.
  50    Otherwise NULL.  */
  51 static struct dev_ino *root_dev_ino;
  52
  53 /* The name of the context file is being given. */
  54 static char const *specified_context;
  55
  56 /* Specific components of the context */
  57 static char const *specified_user;
  58 static char const *specified_role;
  59 static char const *specified_range;
  60 static char const *specified_type;
  61
  62 /* For long options that have no equivalent short option, use a
  63    non-character as a pseudo short option, starting with CHAR_MAX + 1.  */
  64 enum
  65 {
  66   DEREFERENCE_OPTION = CHAR_MAX + 1,
  67   NO_PRESERVE_ROOT,
  68   PRESERVE_ROOT,
  69   REFERENCE_FILE_OPTION
  70 };
  71
  72 static struct option const long_options[] =
  73 {
  74   {"recursive", no_argument, NULL, 'R'},
  75   {"dereference", no_argument, NULL, DEREFERENCE_OPTION},
  76   {"no-dereference", no_argument, NULL, 'h'},
  77   {"no-preserve-root", no_argument, NULL, NO_PRESERVE_ROOT},
  78   {"preserve-root", no_argument, NULL, PRESERVE_ROOT},
  79   {"reference", required_argument, NULL, REFERENCE_FILE_OPTION},
  80   {"user", required_argument, NULL, 'u'},
  81   {"role", required_argument, NULL, 'r'},
  82   {"type", required_argument, NULL, 't'},
  83   {"range", required_argument, NULL, 'l'},
  84   {"verbose", no_argument, NULL, 'v'},
  85   {GETOPT_HELP_OPTION_DECL},
  86   {GETOPT_VERSION_OPTION_DECL},
  87   {NULL, 0, NULL, 0}
  88 };
  89
  90 /* Given a security context, CONTEXT, derive a context_t (*RET),
  91    setting any portions selected via the global variables, specified_user,
  92    specified_role, etc.  */
  93 static int
  94 compute_context_from_mask (char const *context, context_t *ret)
  95 {
  96   bool ok = true;
  97   context_t new_context = context_new (context);
  98   if (!new_context)
  99     {
 100       error (0, errno, _("failed to create security context: %s"),
 101              quotearg_colon (context));
 102       return 1;
 103     }
 104
 105 #define SET_COMPONENT(C, comp)                                          \
 106    do                                                                   \
 107      {                                                                  \
 108        if (specified_ ## comp                                           \
 109            && context_ ## comp ## _set ((C), specified_ ## comp))       \
 110          {                                                              \
 111             error (0, errno,                                            \
 112                    _("failed to set %s security context component to %s"), \
 113                    #comp, quote (specified_ ## comp));                  \
 114            ok = false;                                                  \
 115          }                                                              \
 116      }                                                                  \
 117    while (0)
 118
 119   SET_COMPONENT (new_context, user);
 120   SET_COMPONENT (new_context, range);
 121   SET_COMPONENT (new_context, role);
 122   SET_COMPONENT (new_context, type);
 123
 124   if (!ok)
 125     {
 126       int saved_errno = errno;
 127       context_free (new_context);
 128       errno = saved_errno;
 129       return 1;
 130     }
 131
 132   *ret = new_context;
 133   return 0;
 134 }
 135
 136 /* Change the context of FILE, using specified components.
 137    If it is a directory and -R is given, recurse.
 138    Return 0 if successful, 1 if errors occurred. */
 139
 140 static int
 141 change_file_context (int fd, char const *file)
 142 {
 143   char *file_context = NULL;
 144   context_t context IF_LINT (= 0);
 145   char const * context_string;
 146   int errors = 0;
 147
 148   if (specified_context == NULL)
 149     {
 150       int status = (affect_symlink_referent
 151                     ? getfileconat (fd, file, &file_context)
 152                     : lgetfileconat (fd, file, &file_context));
 153
 154       if (status < 0 && errno != ENODATA)
 155         {
 156           error (0, errno, _("failed to get security context of %s"),
 157                  quote (file));
 158           return 1;
 159         }
 160
 161       /* If the file doesn't have a context, and we're not setting all of
 162          the context components, there isn't really an obvious default.
 163          Thus, we just give up. */
 164       if (file_context == NULL)
 165         {
 166           error (0, 0, _("can't apply partial context to unlabeled file %s"),
 167                  quote (file));
 168           return 1;
 169         }
 170
 171       if (compute_context_from_mask (file_context, &context))
 172         return 1;
 173
 174       context_string = context_str (context);
 175     }
 176   else
 177     {
 178       context_string = specified_context;
 179     }
 180
 181   if (file_context == NULL || ! STREQ (context_string, file_context))
 182     {
 183       int fail = (affect_symlink_referent
 184                   ?  setfileconat (fd, file, se_const (context_string))
 185                   : lsetfileconat (fd, file, se_const (context_string)));
 186
 187       if (fail)
 188         {
 189           errors = 1;
 190           error (0, errno, _("failed to change context of %s to %s"),
 191                  quote_n (0, file), quote_n (1, context_string));
 192         }
 193     }
 194
 195   if (specified_context == NULL)
 196     {
 197       context_free (context);
 198       freecon (file_context);
 199     }
 200
 201   return errors;
 202 }
 203
 204 /* Change the context of FILE.
 205    Return true if successful.  This function is called
 206    once for every file system object that fts encounters.  */
 207
 208 static bool
 209 process_file (FTS *fts, FTSENT *ent)
 210 {
 211   char const *file_full_name = ent->fts_path;
 212   char const *file = ent->fts_accpath;
 213   const struct stat *file_stats = ent->fts_statp;
 214   bool ok = true;
 215
 216   switch (ent->fts_info)
 217     {
 218     case FTS_D:
 219       if (recurse)
 220         {
 221           if (ROOT_DEV_INO_CHECK (root_dev_ino, ent->fts_statp))
 222             {
 223               /* This happens e.g., with "chcon -R --preserve-root ... /"
 224                  and with "chcon -RH --preserve-root ... symlink-to-root".  */
 225               ROOT_DEV_INO_WARN (file_full_name);
 226               /* Tell fts not to traverse into this hierarchy.  */
 227               fts_set (fts, ent, FTS_SKIP);
 228               /* Ensure that we do not process "/" on the second visit.  */
 229               ignore_value (fts_read (fts));
 230               return false;
 231             }
 232           return true;
 233         }
 234       break;
 235
 236     case FTS_DP:
 237       if (! recurse)
 238         return true;
 239       break;
 240
 241     case FTS_NS:
 242       /* For a top-level file or directory, this FTS_NS (stat failed)
 243          indicator is determined at the time of the initial fts_open call.
 244          With programs like chmod, chown, and chgrp, that modify
 245          permissions, it is possible that the file in question is
 246          accessible when control reaches this point.  So, if this is
 247          the first time we've seen the FTS_NS for this file, tell
 248          fts_read to stat it "again".  */
 249       if (ent->fts_level == 0 && ent->fts_number == 0)
 250         {
 251           ent->fts_number = 1;
 252           fts_set (fts, ent, FTS_AGAIN);
 253           return true;
 254         }
 255       error (0, ent->fts_errno, _("cannot access %s"), quote (file_full_name));
 256       ok = false;
 257       break;
 258
 259     case FTS_ERR:
 260       error (0, ent->fts_errno, "%s", quote (file_full_name));
 261       ok = false;
 262       break;
 263
 264     case FTS_DNR:
 265       error (0, ent->fts_errno, _("cannot read directory %s"),
 266              quote (file_full_name));
 267       ok = false;
 268       break;
 269
 270     case FTS_DC:                /* directory that causes cycles */
 271       if (cycle_warning_required (fts, ent))
 272         {
 273           emit_cycle_warning (file_full_name);
 274           return false;
 275         }
 276       break;
 277
 278     default:
 279       break;
 280     }
 281
 282   if (ent->fts_info == FTS_DP
 283       && ok && ROOT_DEV_INO_CHECK (root_dev_ino, file_stats))
 284     {
 285       ROOT_DEV_INO_WARN (file_full_name);
 286       ok = false;
 287     }
 288
 289   if (ok)
 290     {
 291       if (verbose)
 292         printf (_("changing security context of %s\n"),
 293                 quote (file_full_name));
 294
 295       if (change_file_context (fts->fts_cwd_fd, file) != 0)
 296         ok = false;
 297     }
 298
 299   if ( ! recurse)
 300     fts_set (fts, ent, FTS_SKIP);
 301
 302   return ok;
 303 }
 304
 305 /* Recursively operate on the specified FILES (the last entry
 306    of which is NULL).  BIT_FLAGS controls how fts works.
 307    Return true if successful.  */
 308
 309 static bool
 310 process_files (char **files, int bit_flags)
 311 {
 312   bool ok = true;
 313
 314   FTS *fts = xfts_open (files, bit_flags, NULL);
 315
 316   while (1)
 317     {
 318       FTSENT *ent;
 319
 320       ent = fts_read (fts);
 321       if (ent == NULL)
 322         {
 323           if (errno != 0)
 324             {
 325               /* FIXME: try to give a better message  */
 326               error (0, errno, _("fts_read failed"));
 327               ok = false;
 328             }
 329           break;
 330         }
 331
 332       ok &= process_file (fts, ent);
 333     }
 334
 335   if (fts_close (fts) != 0)
 336     {
 337       error (0, errno, _("fts_close failed"));
 338       ok = false;
 339     }
 340
 341   return ok;
 342 }
 343
 344 void
 345 usage (int status)
 346 {
 347   if (status != EXIT_SUCCESS)
 348     emit_try_help ();
 349   else
 350     {
 351       printf (_("\
 352 Usage: %s [OPTION]... CONTEXT FILE...\n\
 353   or:  %s [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...\n\
 354   or:  %s [OPTION]... --reference=RFILE FILE...\n\
 355 "),
 356         program_name, program_name, program_name);
 357       fputs (_("\
 358 Change the SELinux security context of each FILE to CONTEXT.\n\
 359 With --reference, change the security context of each FILE to that of RFILE.\n\
 360 "), stdout);
 361
 362       emit_mandatory_arg_note ();
 363
 364       fputs (_("\
 365       --dereference      affect the referent of each symbolic link (this is\n\
 366                          the default), rather than the symbolic link itself\n\
 367   -h, --no-dereference   affect symbolic links instead of any referenced file\n\
 368 "), stdout);
 369       fputs (_("\
 370   -u, --user=USER        set user USER in the target security context\n\
 371   -r, --role=ROLE        set role ROLE in the target security context\n\
 372   -t, --type=TYPE        set type TYPE in the target security context\n\
 373   -l, --range=RANGE      set range RANGE in the target security context\n\
 374 "), stdout);
 375       fputs (_("\
 376       --no-preserve-root  do not treat '/' specially (the default)\n\
 377       --preserve-root    fail to operate recursively on '/'\n\
 378 "), stdout);
 379       fputs (_("\
 380       --reference=RFILE  use RFILE's security context rather than specifying\n\
 381                          a CONTEXT value\n\
 382 "), stdout);
 383       fputs (_("\
 384   -R, --recursive        operate on files and directories recursively\n\
 385 "), stdout);
 386       fputs (_("\
 387   -v, --verbose          output a diagnostic for every file processed\n\
 388 "), stdout);
 389       fputs (_("\
 390 \n\
 391 The following options modify how a hierarchy is traversed when the -R\n\
 392 option is also specified.  If more than one is specified, only the final\n\
 393 one takes effect.\n\
 394 \n\
 395   -H                     if a command line argument is a symbolic link\n\
 396                          to a directory, traverse it\n\
 397   -L                     traverse every symbolic link to a directory\n\
 398                          encountered\n\
 399   -P                     do not traverse any symbolic links (default)\n\
 400 \n\
 401 "), stdout);
 402       fputs (HELP_OPTION_DESCRIPTION, stdout);
 403       fputs (VERSION_OPTION_DESCRIPTION, stdout);
 404       emit_ancillary_info (PROGRAM_NAME);
 405     }
 406   exit (status);
 407 }
 408
 409 int
 410 main (int argc, char **argv)
 411 {
 412   /* Bit flags that control how fts works.  */
 413   int bit_flags = FTS_PHYSICAL;
 414
 415   /* 1 if --dereference, 0 if --no-dereference, -1 if neither has been
 416      specified.  */
 417   int dereference = -1;
 418
 419   bool ok;
 420   bool preserve_root = false;
 421   bool component_specified = false;
 422   char *reference_file = NULL;
 423   int optc;
 424
 425   initialize_main (&argc, &argv);
 426   set_program_name (argv[0]);
 427   setlocale (LC_ALL, "");
 428   bindtextdomain (PACKAGE, LOCALEDIR);
 429   textdomain (PACKAGE);
 430
 431   atexit (close_stdout);
 432
 433   while ((optc = getopt_long (argc, argv, "HLPRhvu:r:t:l:", long_options, NULL))
 434          != -1)
 435     {
 436       switch (optc)
 437         {
 438         case 'H': /* Traverse command-line symlinks-to-directories.  */
 439           bit_flags = FTS_COMFOLLOW | FTS_PHYSICAL;
 440           break;
 441
 442         case 'L': /* Traverse all symlinks-to-directories.  */
 443           bit_flags = FTS_LOGICAL;
 444           break;
 445
 446         case 'P': /* Traverse no symlinks-to-directories.  */
 447           bit_flags = FTS_PHYSICAL;
 448           break;
 449
 450         case 'h': /* --no-dereference: affect symlinks */
 451           dereference = 0;
 452           break;
 453
 454         case DEREFERENCE_OPTION: /* --dereference: affect the referent
 455                                     of each symlink */
 456           dereference = 1;
 457           break;
 458
 459         case NO_PRESERVE_ROOT:
 460           preserve_root = false;
 461           break;
 462
 463         case PRESERVE_ROOT:
 464           preserve_root = true;
 465           break;
 466
 467         case REFERENCE_FILE_OPTION:
 468           reference_file = optarg;
 469           break;
 470
 471         case 'R':
 472           recurse = true;
 473           break;
 474
 475         case 'f':
 476           /* ignore */
 477           break;
 478
 479         case 'v':
 480           verbose = true;
 481           break;
 482
 483         case 'u':
 484           specified_user = optarg;
 485           component_specified = true;
 486           break;
 487
 488         case 'r':
 489           specified_role = optarg;
 490           component_specified = true;
 491           break;
 492
 493         case 't':
 494           specified_type = optarg;
 495           component_specified = true;
 496           break;
 497
 498         case 'l':
 499           specified_range = optarg;
 500           component_specified = true;
 501           break;
 502
 503         case_GETOPT_HELP_CHAR;
 504         case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
 505         default:
 506           usage (EXIT_FAILURE);
 507         }
 508     }
 509
 510   if (recurse)
 511     {
 512       if (bit_flags == FTS_PHYSICAL)
 513         {
 514           if (dereference == 1)
 515             error (EXIT_FAILURE, 0,
 516                    _("-R --dereference requires either -H or -L"));
 517           affect_symlink_referent = false;
 518         }
 519       else
 520         {
 521           if (dereference == 0)
 522             error (EXIT_FAILURE, 0, _("-R -h requires -P"));
 523           affect_symlink_referent = true;
 524         }
 525     }
 526   else
 527     {
 528       bit_flags = FTS_PHYSICAL;
 529       affect_symlink_referent = (dereference != 0);
 530     }
 531
 532   if (argc - optind < (reference_file || component_specified ? 1 : 2))
 533     {
 534       if (argc <= optind)
 535         error (0, 0, _("missing operand"));
 536       else
 537         error (0, 0, _("missing operand after %s"), quote (argv[argc - 1]));
 538       usage (EXIT_FAILURE);
 539     }
 540
 541   if (reference_file)
 542     {
 543       char *ref_context = NULL;
 544
 545       if (getfilecon (reference_file, &ref_context) < 0)
 546         error (EXIT_FAILURE, errno, _("failed to get security context of %s"),
 547                quote (reference_file));
 548
 549       specified_context = ref_context;
 550     }
 551   else if (component_specified)
 552     {
 553       /* FIXME: it's already null, so this is a no-op. */
 554       specified_context = NULL;
 555     }
 556   else
 557     {
 558       specified_context = argv[optind++];
 559       if (security_check_context (se_const (specified_context)) < 0)
 560         error (EXIT_FAILURE, errno, _("invalid context: %s"),
 561                quotearg_colon (specified_context));
 562     }
 563
 564   if (reference_file && component_specified)
 565     {
 566       error (0, 0, _("conflicting security context specifiers given"));
 567       usage (EXIT_FAILURE);
 568     }
 569
 570   if (recurse && preserve_root)
 571     {
 572       static struct dev_ino dev_ino_buf;
 573       root_dev_ino = get_root_dev_ino (&dev_ino_buf);
 574       if (root_dev_ino == NULL)
 575         error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
 576                quote ("/"));
 577     }
 578   else
 579     {
 580       root_dev_ino = NULL;
 581     }
 582
 583   ok = process_files (argv + optind, bit_flags | FTS_NOSTAT);
 584
 585   return ok ? EXIT_SUCCESS : EXIT_FAILURE;
 586 }