Proposing SELinux support in strace

[Renaud Métrich]

Hi Dmitry,

Thank you for your hard work here, it's perfect to me.

This new subdir.c entries are indeed nice.

Now that I'm now more used to strace development, I hope to be able to 
propose other enhancements in the future that will require less work 
from your side.

Best regards,

Renaud.

On 4/4/21 2:53 AM, Dmitry V. Levin wrote:
> Hi Renaud,
>
> On Tue, Mar 30, 2021 at 04:47:59AM +0300, Dmitry V. Levin wrote:
>> On Mon, Mar 29, 2021 at 05:36:42PM +0200, Renaud Métrich wrote:
>>> Thanks, all fixed, PR updated accordindly.
>>>
>>> I introduced stripping of trailing newlines in the context (see
>>> selinux.c), after digging into a CI issue for a few hours:
>>>
>>> for some reason, on the CI, the context for processes (there is no file
>>> contexts at all) have a trailing "\n" (actually it's "unconfined\n")!
>>>
>>> I think it's safe to keep this stripping in the normal code, just in
>>> case, that would avoid unintended newlines in strace output.
>> I also think it's OK.
> I've prepared and pushed to branch ldv/secontext an edition that seems
> to be OK, at least it passes tests on many different systems.
>
> There are some cosmetic changes in non-tests area:
> - renamed USE_SELINUX to ENABLE_SECONTEXT;
> - renamed with_secontexts to enable_secontext;
> - renamed selinux.[ch] to secontext.[ch];
> - renamed SELINUX_OPT to SECONTEXT_OPT;
> - renamed GETOPT_SELINUX_CONTEXT to GETOPT_SECONTEXT.
> These changed shouldn't affect the generated code.
>
> There are some changes in tests, too:
> - moved fchmod-y test to a separate commit along with dirfd.c,
>    replaced get_curdir_fd with get_fd_path;
> - added a commit introducing a pair of functions that is going to be used
>    to make sure the current workdir of the tracee is different from the
>    current workdir of the tracer, which is relevant with --secontext option;
> - replaced all tests/execve--secontext*.c files and their corresponding
>    tests/Makefile.am data with gen_secontext.sh script that generated all
>    these files and the tests/Makefile.am data from tests/gen_tests.in;
> - rewrote selinux.c into secontext.c and secontext.h.
>
> Looks like some of tests are now expecting some of *at functions to work,
> such tests should no longer pass on systems where old *at syscalls are not
> supported by the kernel, but I don't see any such regressions anywhere
> I can run tests, so this is probably OK.
>
> Please have a look whether it's fine with you.
>
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strace.io/pipermail/strace-devel/attachments/20210405/9055d6eb/attachment.bin>