diff options
| author | Renaud Métrich <rmetrich@redhat.com> | 2020-01-29 15:22:47 +0100 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2021-04-04 12:04:24 +0000 |
| commit | e921913eecd5025dae688fdf9c365023fe3b8a0c (patch) | |
| tree | b0ba2a6ba4ef974badff858496d0df13474de545 /tests/access.c | |
| parent | b19eaf8aa02f95b7e0e395d74e0c6af0600b5fac (diff) | |
| download | strace-e921913eecd5025dae688fdf9c365023fe3b8a0c.tar.gz | |
Implement --secontext[=full] option to display SELinux contextsldv/secontext
This is very useful when debugging SELinux issues, in particular, when
a process runs in an unexpected context or didn't transition properly,
or typically when a file being opened does not have the proper context.
When --secontext=full is specified, strace will print the complete
context (user, role, type and category) instead of just the type which
is printed for --secontext option, as shown in the examples below:
Without any "--secontext" options:
-----------------------------------------------------------------------
118104 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys", O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> <0.000399>
-----------------------------------------------------------------------
With "--secontext=full" option:
-----------------------------------------------------------------------
118104 [system_u:system_r:sshd_t:s0-s0:c0.c1023] 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 [system_u:system_r:sshd_t:s0-s0:c0.c1023] 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys" [system_u:object_r:nfs_t:s0], O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> [system_u:object_r:nfs_t:s0] <0.000399>
-----------------------------------------------------------------------
With "--secontext" option:
-----------------------------------------------------------------------
118104 [sshd_t] 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 [sshd_t] 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys" [nfs_t], O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> [nfs_t] <0.000399>
-----------------------------------------------------------------------
To implement this, a new "--with-libselinux" configure option has been
introduced. It defaults to "check", which means automatic support on
SELinux aware systems.
Co-authored-by: Dmitry V. Levin <ldv@strace.io>
Diffstat (limited to 'tests/access.c')
| -rw-r--r-- | tests/access.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/tests/access.c b/tests/access.c index fe7e21d5b..5d37ba534 100644 --- a/tests/access.c +++ b/tests/access.c @@ -10,9 +10,12 @@ #ifdef __NR_access +# include <fcntl.h> # include <stdio.h> # include <unistd.h> +# include "secontext.h" + int main(void) { @@ -22,15 +25,27 @@ main(void) */ create_and_enter_subdir("access_subdir"); + char *my_secontext = SECONTEXT_PID_MY(); + static const char sample[] = "access_sample"; + (void) unlink(sample); + if (open(sample, O_CREAT|O_RDONLY, 0400) == -1) + perror_msg_and_fail("open: %s", sample); long rc = syscall(__NR_access, sample, F_OK); - printf("access(\"%s\", F_OK) = %ld %s (%m)\n", - sample, rc, errno2name()); + printf("%s%s(\"%s\"%s, F_OK) = %s\n", + my_secontext, "access", + sample, SECONTEXT_FILE(sample), + sprintrc(rc)); + + if (unlink(sample)) + perror_msg_and_fail("unlink: %s", sample); rc = syscall(__NR_access, sample, R_OK|W_OK|X_OK); - printf("access(\"%s\", R_OK|W_OK|X_OK) = %ld %s (%m)\n", - sample, rc, errno2name()); + printf("%s%s(\"%s\", R_OK|W_OK|X_OK) = %s\n", + my_secontext, "access", + sample, + sprintrc(rc)); leave_and_remove_subdir(); |