On 11/11/2024 16:47, Paul Eggert wrote:
On 2024-11-10 05:48, Pádraig Brady wrote:
BTW I've pushed a tweak to gnulib to avoid a -Werror=unused-variable
issue with --disable-acl
Thanks, I installed the attached further patch, since the res5t of the
file uses MAYBE_UNUSED.
Thanks for all the fixes.
With the attached two small changes, it all looks good here now.
I'll wait until tomorrow to apply these, in case it overlaps
with any changes you're making.
cheers,
Pádraig
From 00c45be7875e159b35ab6cd9fcfb2733fde95d41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <p...@draigbrady.com>
Date: Mon, 11 Nov 2024 18:55:19 +0000
Subject: [PATCH 1/2] ls: fix security context indication in --long mode
* src/ls.c (gobble_file): Always get the security context with -l
so that we can indicate a context with '.' if present.
---
src/ls.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/ls.c b/src/ls.c
index 6ff0f410f..6422022d2 100644
--- a/src/ls.c
+++ b/src/ls.c
@@ -3501,8 +3501,9 @@ gobble_file (char const *name, enum filetype type, ino_t inode,
if ((format == long_format) | print_scontext | check_capability)
{
struct aclinfo ai;
+ bool get_scontext = (format == long_format) | print_scontext;
int aclinfo_flags = ((do_deref ? ACL_SYMLINK_FOLLOW : 0)
- | (print_scontext ? ACL_GET_SCONTEXT : 0)
+ | (get_scontext ? ACL_GET_SCONTEXT : 0)
| filetype_d_type[type]);
int n = file_has_aclinfo_cache (full_name, f, &ai, aclinfo_flags);
bool have_acl = 0 < n;
--
2.47.0
From 8be8b3d1e4ca97de151e5070c5ae5f42c0f8f896 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <p...@draigbrady.com>
Date: Mon, 11 Nov 2024 19:54:18 +0000
Subject: [PATCH 2/2] tests: avoid false failure with --disable-selinux
* tests/ls/selinux-segfault.sh: Move recent addition to ...
* tests/ls/selinux.sh: ... this new test that uses require_selinux_
to skip appropriately when we've built without selinux support.
Also add a non root test that checks we output '.' along with the
mode for files, to indicate a security context is present.
* tests/local.mk (Reference the new test).
---
tests/local.mk | 1 +
tests/ls/selinux-segfault.sh | 15 --------------
tests/ls/selinux.sh | 40 ++++++++++++++++++++++++++++++++++++
3 files changed, 41 insertions(+), 15 deletions(-)
create mode 100755 tests/ls/selinux.sh
diff --git a/tests/local.mk b/tests/local.mk
index 3223b58aa..f4e687fe8 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -647,6 +647,7 @@ all_tests = \
tests/ls/removed-directory.sh \
tests/ls/root-rel-symlink-color.sh \
tests/ls/rt-1.sh \
+ tests/ls/selinux.sh \
tests/ls/slink-acl.sh \
tests/ls/stat-dtype.sh \
tests/ls/stat-failed.sh \
diff --git a/tests/ls/selinux-segfault.sh b/tests/ls/selinux-segfault.sh
index 9ac1d950c..ebcfbfe13 100755
--- a/tests/ls/selinux-segfault.sh
+++ b/tests/ls/selinux-segfault.sh
@@ -30,19 +30,4 @@ mkdir sedir || framework_failure_
ln -sf missing sedir/broken || framework_failure_
returns_ 1 ls -L -R -Z -m sedir > out || fail=1
-nl='
-'
-if sestatus=$(LC_ALL=C sestatus); then
- sestatus_line_1=${sestatus%%$nl*}
- case $sestatus_line_1 in
- 'SELinux status:'*' enabled')
- ls_output=$(LC_ALL=C ls -lnZ sedir/broken) || fail=1
- set x $ls_output
- case $6 in
- *:*:*:*) ;;
- *) fail=1;
- esac
- esac
-fi
-
Exit $fail
diff --git a/tests/ls/selinux.sh b/tests/ls/selinux.sh
new file mode 100755
index 000000000..e9aca4bb7
--- /dev/null
+++ b/tests/ls/selinux.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+# Test basic selinux output
+
+# Copyright (C) 2024 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
+print_ver_ ls
+require_selinux_
+
+touch f || framework_failure_
+case $(stat --printf='%C' f) in
+ *:*:*:*) ;;
+ *) skip_ 'unable to match default security context';;
+esac
+
+# ensure that ls -l output includes the "."
+test "$(ls -l f|cut -c11)" = . || fail=1
+
+# ensure that ls -lZ output includes context
+ls_output=$(LC_ALL=C ls -lnZ f) || fail=1
+set x $ls_output
+case $6 in
+ *:*:*:*) ;;
+ *) fail=1 ;;
+esac
+
+Exit $fail
--
2.47.0
