tools: switch SELinux to runtime optional via dlopen

Replace direct libselinux linking with runtime dlopen() using the
shared dl-utils infrastructure. All tools that use SELinux functions
now call them through selinux_call() macro and gracefully handle the
case when libselinux is not installed at runtime.

Affected tools: mkswap, chfn, chsh, lslogins, sulogin, vipw, namei,
mount, nsenter, login.

Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/disk-utils/Makemodule.am b/disk-utils/Makemodule.am
index 178bb9da6a505a3c8e7de54f7ce09c769098c9cf..069213ddf230d572090b1a17cf98707c0aa9738d 100644 (file)
--- a/disk-utils/Makemodule.am
+++ b/disk-utils/Makemodule.am
@@ -71,10 +71,15 @@ mkswap_CFLAGS += -I$(ul_libblkid_incdir)
 mkswap_LDADD += libblkid.la
 endif
 if HAVE_SELINUX
-mkswap_LDADD += $(SELINUX_LIBS)
 mkswap_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h \
        lib/selinux-utils.c \
        include/selinux-utils.h
+mkswap_LDADD += -ldl
+mkswap_CFLAGS += $(SELINUX_CFLAGS)
 endif
 endif # BUILD_MKSWAP
 

diff --git a/disk-utils/meson.build b/disk-utils/meson.build
index e576e3012a8f6faaa79a44c0ea7ae70b4f3df082..93603e46255307d1541eac647dd46c96a10a1432 100644 (file)
--- a/disk-utils/meson.build
+++ b/disk-utils/meson.build
@@ -18,7 +18,7 @@ mkswap_sources = files(
 ) + \
   ismounted_c
 if lib_selinux.found()
-  mkswap_sources += selinux_utils_c
+  mkswap_sources += [dl_utils_c, dl_selinux_c, selinux_utils_c]
 endif
 mkswap_manadocs = files('mkswap.8.adoc')
 

diff --git a/disk-utils/mkswap.c b/disk-utils/mkswap.c
index a820a8815ca02aeb579c01832674f71a88c9860d..2a081a97de237b46610fadac1f5e3ef3fe1e6393 100644 (file)
--- a/disk-utils/mkswap.c
+++ b/disk-utils/mkswap.c
@@ -29,8 +29,7 @@
 #include <getopt.h>
 #include <assert.h>
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
-# include <selinux/context.h>
+# include "dl-selinux.h"
 # include "selinux-utils.h"
 #endif
 #ifdef HAVE_LINUX_FS_H
@@ -803,12 +802,13 @@ int main(int argc, char **argv)
        deinit_signature_page(&ctl);
 
 #ifdef HAVE_LIBSELINUX
-       if ((ctl.file || S_ISREG(ctl.devstat.st_mode)) && is_selinux_enabled() > 0) {
+       if ((ctl.file || S_ISREG(ctl.devstat.st_mode))
+           && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                const char *context_string;
                char *oldcontext;
                context_t newcontext;
 
-               if (fgetfilecon(ctl.fd, &oldcontext) < 0) {
+               if (selinux_call(fgetfilecon)(ctl.fd, &oldcontext) < 0) {
                        if (errno != ENODATA)
                                err(EXIT_FAILURE,
                                        _("%s: unable to obtain selinux file label"),
@@ -819,20 +819,20 @@ int main(int argc, char **argv)
                                        _("%s: unable to obtain default selinux file label"),
                                        ctl.devname);
                }
-               if (!(newcontext = context_new(oldcontext)))
+               if (!(newcontext = selinux_call(context_new)(oldcontext)))
                        errx(EXIT_FAILURE, _("unable to create new selinux context"));
-               if (context_type_set(newcontext, SELINUX_SWAPFILE_TYPE))
+               if (selinux_call(context_type_set)(newcontext, SELINUX_SWAPFILE_TYPE))
                        errx(EXIT_FAILURE, _("couldn't compute selinux context"));
 
-               context_string = context_str(newcontext);
+               context_string = selinux_call(context_str)(newcontext);
 
                if (strcmp(context_string, oldcontext)!=0) {
-                       if (fsetfilecon(ctl.fd, context_string) && errno != ENOTSUP)
+                       if (selinux_call(fsetfilecon)(ctl.fd, context_string) && errno != ENOTSUP)
                                err(EXIT_FAILURE, _("unable to relabel %s to %s"),
                                                ctl.devname, context_string);
                }
-               context_free(newcontext);
-               freecon(oldcontext);
+               selinux_call(context_free)(newcontext);
+               selinux_call(freecon)(oldcontext);
        }
 #endif
        /*

diff --git a/login-utils/Makemodule.am b/login-utils/Makemodule.am
index a82e4b70f201dc84b29510edb6bf697b929fb0d2..e08dd4cb93f9b78cf4b928a3418a26e952aaf866 100644 (file)
--- a/login-utils/Makemodule.am
+++ b/login-utils/Makemodule.am
@@ -43,7 +43,13 @@ if HAVE_LIBCRYPT
 sulogin_LDADD += -lcrypt
 endif
 if HAVE_SELINUX
-sulogin_LDADD += $(SELINUX_LIBS)
+sulogin_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+sulogin_LDADD += -ldl
+sulogin_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS)
 endif
 
 check_PROGRAMS += test_consoles
@@ -66,9 +72,6 @@ endif
 if HAVE_AUDIT
 login_LDADD += $(AUDIT_LIBS)
 endif
-if HAVE_SELINUX
-login_LDADD += $(SELINUX_LIBS)
-endif
 endif # BUILD_LOGIN
 
 
@@ -132,9 +135,14 @@ endif
 
 if HAVE_SELINUX
 chfn_chsh_sources += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h \
        lib/selinux-utils.c \
        include/selinux-utils.h
-chfn_chsh_ldadd += $(SELINUX_LIBS)
+chfn_chsh_ldadd += -ldl
+chfn_chsh_cflags += $(SELINUX_CFLAGS)
 endif
 
 chfn_SOURCES = \
@@ -219,7 +227,13 @@ lslogins_SOURCES = \
 lslogins_LDADD = $(LDADD) libcommon.la libcommon_logindefs.la libsmartcols.la
 lslogins_CFLAGS = $(AM_CFLAGS) -I$(ul_libsmartcols_incdir)
 if HAVE_SELINUX
-lslogins_LDADD += $(SELINUX_LIBS)
+lslogins_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+lslogins_LDADD += -ldl
+lslogins_CFLAGS += $(SELINUX_CFLAGS)
 endif
 if HAVE_SYSTEMD
 lslogins_LDADD += $(SYSTEMD_LIBS) $(SYSTEMD_JOURNAL_LIBS)
@@ -242,7 +256,13 @@ vipw_SOURCES = \
        login-utils/setpwnam.h
 vipw_LDADD = $(LDADD) libcommon.la
 if HAVE_SELINUX
-vipw_LDADD += $(SELINUX_LIBS)
+vipw_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+vipw_LDADD += -ldl
+vipw_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS)
 endif
 install-exec-hook-vipw::
        cd $(DESTDIR)$(usrsbin_execdir) && ln -sf vipw vigr

diff --git a/login-utils/chfn.c b/login-utils/chfn.c
index efc58159e56fda63d9df8d49b3b7dce8f6049974..251e9e50fde6f187a8267b7c57022803f0ba3dc8 100644 (file)
--- a/login-utils/chfn.c
+++ b/login-utils/chfn.c
@@ -48,7 +48,7 @@
 #include "pwdutils.h"
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 # include "selinux-utils.h"
 #endif
 
@@ -462,7 +462,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifdef HAVE_LIBSELINUX
-       if (is_selinux_enabled() > 0) {
+       if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                char *user_cxt = NULL;
 
                if (uid == 0 && !ul_selinux_has_access("passwd", "chfn", &user_cxt))

diff --git a/login-utils/chsh.c b/login-utils/chsh.c
index 7effd3006b5fde80030e6774381683998b01aae6..b2f983afafc0698c1eaa6089d5870e62c298f85b 100644 (file)
--- a/login-utils/chsh.c
+++ b/login-utils/chsh.c
@@ -47,7 +47,7 @@
 #include "shells.h"
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 # include "selinux-utils.h"
 #endif
 
@@ -219,7 +219,7 @@ int main(int argc, char **argv)
 #endif
 
 #ifdef HAVE_LIBSELINUX
-       if (is_selinux_enabled() > 0) {
+       if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                char *user_cxt = NULL;
 
                if (uid == 0 && !ul_selinux_has_access("passwd", "chsh", &user_cxt))

diff --git a/login-utils/lslogins.c b/login-utils/lslogins.c
index fa69529f48ba54a33e20d4e5a14d693b6b351fc5..6837c76fd377f633c4469b71edde73ac7d756d0a 100644 (file)
--- a/login-utils/lslogins.c
+++ b/login-utils/lslogins.c
@@ -39,7 +39,7 @@
 
 #include <libsmartcols.h>
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 #endif
 
 #ifdef HAVE_LIBSYSTEMD
@@ -1022,7 +1022,7 @@ static struct lslogins_user *get_user_info(struct lslogins_control *ctl, const c
                        break;
                case COL_SELINUX:
 #ifdef HAVE_LIBSELINUX
-                       if (!ctl->selinux_enabled || getcon(&user->context) != 0)
+                       if (!ctl->selinux_enabled || selinux_call(getcon)(&user->context) != 0)
                                user->context = NULL;
 #endif
                        break;
@@ -1512,7 +1512,8 @@ static void free_user(void *f)
        free(u->shell);
        free(u->pwd_status);
 #ifdef HAVE_LIBSELINUX
-       freecon(u->context);
+       if (u->context)
+               selinux_call(freecon)(u->context);
 #endif
        free(u);
 }
@@ -1813,7 +1814,10 @@ int main(int argc, char *argv[])
                case 'Z':
                {
 #ifdef HAVE_LIBSELINUX
-                       int sl = is_selinux_enabled();
+                       int sl = 0;
+
+                       if (ul_dlopen_libselinux() == 0)
+                               sl = selinux_call(is_selinux_enabled)();
                        if (sl < 0)
                                warn(_("failed to request selinux state"));
                        else

diff --git a/login-utils/meson.build b/login-utils/meson.build
index 251d8de46016a7094acbc0b64c63f2cd3156eb64..d49d34293f1f5edb54862f3f4a7385223072bba2 100644 (file)
--- a/login-utils/meson.build
+++ b/login-utils/meson.build
@@ -35,8 +35,8 @@ else
 endif
 
 if lib_selinux.found()
-  chfn_chsh_sources += selinux_utils_c
-  chfn_chsh_deps += [lib_selinux]
+  chfn_chsh_sources += [dl_utils_c, dl_selinux_c, selinux_utils_c]
+  chfn_chsh_deps += lib_selinux_dlopen_deps
 endif
 
 chfn_sources = files(

diff --git a/login-utils/sulogin.c b/login-utils/sulogin.c
index 23f5164e6bc74386ffd997b45b2e9e9b65397438..7368be87038ff49a800dd6f9a8edb84d56601ead 100644 (file)
--- a/login-utils/sulogin.c
+++ b/login-utils/sulogin.c
@@ -45,8 +45,7 @@
 #endif
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
-# include <selinux/get_context_list.h>
+# include "dl-selinux.h"
 #endif
 
 #ifdef __linux__
@@ -107,8 +106,12 @@ static int is_selinux_enabled_cached(void)
 {
        static int cache = -1;
 
-       if (cache == -1)
-               cache = is_selinux_enabled();
+       if (cache == -1) {
+               if (ul_dlopen_libselinux() == 0)
+                       cache = selinux_call(is_selinux_enabled)();
+               else
+                       cache = 0;
+       }
 
        return cache;
 }
@@ -127,12 +130,12 @@ static void compute_login_context(void)
        if (is_selinux_enabled_cached() == 0)
                goto cleanup;
 
-       if (getseuserbyname("root", &seuser, &level) == -1) {
+       if (selinux_call(getseuserbyname)("root", &seuser, &level) == -1) {
                warnx(_("failed to compute seuser"));
                goto cleanup;
        }
 
-       if (get_default_context_with_level(seuser, level, NULL, &login_context) == -1) {
+       if (selinux_call(get_default_context_with_level)(seuser, level, NULL, &login_context) == -1) {
                warnx(_("failed to compute default context"));
                goto cleanup;
        }
@@ -152,22 +155,22 @@ static void tcinit_selinux(struct console *con)
        if (!login_context)
                return;
 
-       if (fgetfilecon(con->fd, &con->reset_tty_context) == -1) {
+       if (selinux_call(fgetfilecon)(con->fd, &con->reset_tty_context) == -1) {
                warn(_("failed to get context of terminal %s"), con->tty);
                return;
        }
 
-       tclass = string_to_security_class("chr_file");
+       tclass = selinux_call(string_to_security_class)("chr_file");
        if (tclass == 0) {
                warnx(_("security class chr_file not available"));
-               freecon(con->reset_tty_context);
+               selinux_call(freecon)(con->reset_tty_context);
                con->reset_tty_context = NULL;
                return;
        }
 
-       if (security_compute_relabel(login_context, con->reset_tty_context, tclass, &con->user_tty_context) == -1) {
+       if (selinux_call(security_compute_relabel)(login_context, con->reset_tty_context, tclass, &con->user_tty_context) == -1) {
                warnx(_("failed to compute relabel context of terminal"));
-               freecon(con->reset_tty_context);
+               selinux_call(freecon)(con->reset_tty_context);
                con->reset_tty_context = NULL;
                return;
        }
@@ -926,12 +929,12 @@ static void sushell(struct passwd *pwd, struct console *con)
 #ifdef HAVE_LIBSELINUX
        if (is_selinux_enabled_cached() == 1) {
                if (con->user_tty_context) {
-                       if (fsetfilecon(con->fd, con->user_tty_context) == -1)
+                       if (selinux_call(fsetfilecon)(con->fd, con->user_tty_context) == -1)
                                warn(_("failed to set context to %s for terminal %s"), con->user_tty_context, con->tty);
                }
 
                if (login_context) {
-                       if (setexeccon(login_context) == -1)
+                       if (selinux_call(setexeccon)(login_context) == -1)
                                warn(_("failed to set exec context to %s"), login_context);
                }
        }
@@ -963,10 +966,10 @@ static void tcreset_selinux(struct list_head *consoles)
                        continue;
                if (!con->reset_tty_context)
                        continue;
-               if (fsetfilecon(con->fd, con->reset_tty_context) == -1)
+               if (selinux_call(fsetfilecon)(con->fd, con->reset_tty_context) == -1)
                        warn(_("failed to reset context to %s for terminal %s"), con->reset_tty_context, con->tty);
 
-               freecon(con->reset_tty_context);
+               selinux_call(freecon)(con->reset_tty_context);
                con->reset_tty_context = NULL;
        }
 }

diff --git a/login-utils/vipw.c b/login-utils/vipw.c
index 25d148685017b456e28b256c84f446b21276e2fc..093ba608246355f3421887c5470c91a10a0eebd5 100644 (file)
--- a/login-utils/vipw.c
+++ b/login-utils/vipw.c
@@ -70,7 +70,7 @@
 #include "rpmatch.h"
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 #endif
 
 #define FILENAMELEN 67
@@ -149,16 +149,16 @@ static void pw_write(void)
                warn(_("%s: create a link to %s failed"), orig_file, tmp);
 
 #ifdef HAVE_LIBSELINUX
-       if (is_selinux_enabled() > 0) {
+       if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                char *passwd_context = NULL;
                int ret = 0;
 
-               if (getfilecon(orig_file, &passwd_context) < 0) {
+               if (selinux_call(getfilecon)(orig_file, &passwd_context) < 0) {
                        warnx(_("Can't get context for %s"), orig_file);
                        pw_error(orig_file, 1, 1);
                }
-               ret = setfilecon(tmp_file, passwd_context);
-               freecon(passwd_context);
+               ret = selinux_call(setfilecon)(tmp_file, passwd_context);
+               selinux_call(freecon)(passwd_context);
                if (ret != 0) {
                        warnx(_("Can't set context for %s"), tmp_file);
                        pw_error(tmp_file, 1, 1);

diff --git a/meson.build b/meson.build
index c4fe2c6f329ff0828362d453d340680c21c0dbb1..b349b18e722e803fb545de9d9f239a43db1e0a48 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -486,10 +486,14 @@ lib_selinux = dependency(
   version : '>= 2.5',
   required : get_option('selinux'))
 conf.set('HAVE_LIBSELINUX', lib_selinux.found() ? 1 : false)
+lib_selinux_compile_deps = []
+lib_selinux_dlopen_deps = []
 if lib_selinux.found()
   have = cc.has_function('security_get_initial_context',
                          dependencies : lib_selinux)
   conf.set('HAVE_SECURITY_GET_INITIAL_CONTEXT', have ? 1 : false)
+  lib_selinux_compile_deps = [lib_selinux.partial_dependency(compile_args : true, includes : true)]
+  lib_selinux_dlopen_deps = lib_selinux_compile_deps + [lib_dl]
 endif
 
 lib_magic = dependency(
@@ -1226,13 +1230,13 @@ opt = get_option('build-lslogins') \
 exe = executable(
   'lslogins',
   'login-utils/lslogins.c',
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common,
                lib_smartcols,
                lib_common_logindefs] +
                (build_liblastlog2 ? [lib_lastlog2] : []),
-  dependencies : [lib_selinux,
-                  lib_systemd],
+  dependencies : [lib_systemd] + lib_selinux_dlopen_deps,
   install_dir : usrbin_exec_dir,
   install : opt,
   build_by_default : opt)
@@ -1249,9 +1253,10 @@ exe = executable(
   'vipw',
   'login-utils/vipw.c',
   'login-utils/setpwnam.h',
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common],
-  dependencies : [lib_selinux],
+  dependencies : lib_selinux_dlopen_deps,
   install_dir : usrbin_exec_dir,
   install : opt,
   build_by_default : opt)
@@ -1969,10 +1974,11 @@ opt = get_option('build-mount').allowed()
 exe = executable(
   'mount',
   mount_sources,
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common,
                lib_smartcols],
-  dependencies : [lib_selinux, mount_dep],
+  dependencies : [mount_dep] + lib_selinux_dlopen_deps,
   install_mode : 'rwsr-xr-x',
   install : opt,
   build_by_default : opt)
@@ -2210,9 +2216,10 @@ opt = get_option('build-nsenter') \
 exe = executable(
   'nsenter',
   nsenter_sources,
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common],
-  dependencies : [lib_selinux],
+  dependencies : lib_selinux_dlopen_deps,
   install_dir : usrbin_exec_dir,
   install : opt,
   build_by_default : opt)
@@ -2226,9 +2233,10 @@ opt = opt and 'nsenter' in static_programs
 exe = executable(
   'nsenter.static',
   nsenter_sources,
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common],
-  dependencies : [lib_selinux],
+  dependencies : lib_selinux_dlopen_deps,
   install_dir : usrbin_exec_dir,
   install : opt,
   build_by_default : opt)
@@ -2395,7 +2403,7 @@ exe = executable(
   include_directories : includes,
   link_with : [lib_common,
                lib_uuid],
-  dependencies: [blkid_dep, lib_selinux],
+  dependencies: [blkid_dep] + lib_selinux_dlopen_deps,
   install_dir : sbindir,
   install : true)
 if not is_disabler(exe)
@@ -2889,8 +2897,7 @@ exe = executable(
   include_directories : includes,
   link_with : [lib_common, lib_common_logindefs, lib_common_shells],
   dependencies : [lib_pam,
-                  lib_audit,
-                  lib_selinux],
+                  lib_audit],
   install : opt,
   build_by_default : opt)
 if opt and not is_disabler(exe)
@@ -2904,10 +2911,10 @@ opt = get_option('build-sulogin') \
 exe = executable(
   'sulogin',
   sulogin_sources,
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
   link_with : [lib_common],
-  dependencies : [lib_crypt,
-                  lib_selinux],
+  dependencies : [lib_crypt] + lib_selinux_dlopen_deps,
   install_dir : sbindir,
   install : opt,
   build_by_default : opt)
@@ -3008,8 +3015,9 @@ opt = get_option('build-namei').allowed()
 exe = executable(
   'namei',
   namei_sources,
+  dl_utils_c, dl_selinux_c,
   include_directories : includes,
-  dependencies : [lib_selinux],
+  dependencies : lib_selinux_dlopen_deps,
   install_dir : usrbin_exec_dir,
   install : opt,
   build_by_default : opt)

diff --git a/misc-utils/Makemodule.am b/misc-utils/Makemodule.am
index 4ff4a0090d9325ed89f7f2add51d6c8c14fc60f4..fead1c2cd240ceaf484ca72a6ee5e8608da26240 100644 (file)
--- a/misc-utils/Makemodule.am
+++ b/misc-utils/Makemodule.am
@@ -69,7 +69,16 @@ usrbin_exec_PROGRAMS += namei
 MANPAGES += misc-utils/namei.1
 dist_noinst_DATA += misc-utils/namei.1.adoc
 namei_SOURCES = misc-utils/namei.c lib/strutils.c lib/idcache.c
-namei_LDADD = $(LDADD) $(SELINUX_LIBS)
+namei_LDADD = $(LDADD)
+if HAVE_SELINUX
+namei_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+namei_LDADD += -ldl
+namei_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS)
+endif
 endif
 
 if BUILD_WHEREIS

diff --git a/misc-utils/namei.c b/misc-utils/namei.c
index d3898e564369ec5a74b4aecfda99450811bbc49f..1d2f7d5ee71591ce9fef210777a1529843ae6e69 100644 (file)
--- a/misc-utils/namei.c
+++ b/misc-utils/namei.c
@@ -32,7 +32,7 @@
 #include <grp.h>
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 #endif
 
 #include "c.h"
@@ -163,9 +163,10 @@ new_namei(struct namei *parent, const char *path, const char *fname, int lev)
        nm->name = xstrdup(fname);
 
 #ifdef HAVE_LIBSELINUX
-       /* Don't use is_selinux_enabled() here. We need info about a context
-        * also on systems where SELinux is (temporary) disabled */
-       nm->context_len = lgetfilecon(path, &nm->context);
+       /* Don't check is_selinux_enabled() -- we want context info even
+        * on systems where SELinux is temporarily disabled */
+       if (ul_dlopen_libselinux() == 0)
+               nm->context_len = selinux_call(lgetfilecon)(path, &nm->context);
 #endif
        if (lstat(path, &nm->st) != 0) {
                nm->noent = errno;

diff --git a/sys-utils/Makemodule.am b/sys-utils/Makemodule.am
index f98c811049ae9b3a299a3a297d8ef1b68f049a20..0ea8bd1355e9795fe3cadf605db9727e4b0978eb 100644 (file)
--- a/sys-utils/Makemodule.am
+++ b/sys-utils/Makemodule.am
@@ -371,9 +371,18 @@ dist_noinst_DATA += \
        sys-utils/fstab.5.adoc \
        sys-utils/umount.8.adoc
 mount_SOURCES = sys-utils/mount.c
-mount_LDADD = $(LDADD) libcommon.la libmount.la $(SELINUX_LIBS)
+mount_LDADD = $(LDADD) libcommon.la libmount.la
 mount_CFLAGS = $(SUID_CFLAGS) $(AM_CFLAGS) -I$(ul_libmount_incdir)
 mount_LDFLAGS = $(SUID_LDFLAGS) $(AM_LDFLAGS)
+if HAVE_SELINUX
+mount_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+mount_LDADD += -ldl
+mount_CFLAGS += $(SELINUX_CFLAGS)
+endif
 
 umount_SOURCES = sys-utils/umount.c
 umount_LDADD = $(LDADD) libcommon.la libmount.la
@@ -385,7 +394,7 @@ bin_PROGRAMS += mount.static
 mount_static_SOURCES = $(mount_SOURCES)
 mount_static_CFLAGS = $(mount_CFLAGS)
 mount_static_LDFLAGS = $(mount_LDFLAGS) -all-static
-mount_static_LDADD = $(mount_LDADD) $(SELINUX_LIBS_STATIC)
+mount_static_LDADD = $(mount_LDADD)
 endif
 
 if HAVE_STATIC_UMOUNT
@@ -541,7 +550,16 @@ MANPAGES += sys-utils/nsenter.1
 dist_noinst_DATA += sys-utils/nsenter.1.adoc
 nsenter_SOURCES = sys-utils/nsenter.c lib/exec_shell.c \
                  lib/caputils.c
-nsenter_LDADD = $(LDADD) libcommon.la $(SELINUX_LIBS)
+nsenter_LDADD = $(LDADD) libcommon.la
+if HAVE_SELINUX
+nsenter_SOURCES += \
+       lib/dl-utils.c \
+       include/dl-utils.h \
+       lib/dl-selinux.c \
+       include/dl-selinux.h
+nsenter_LDADD += -ldl
+nsenter_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS)
+endif
 
 if HAVE_STATIC_NSENTER
 usrbin_exec_PROGRAMS += nsenter.static

diff --git a/sys-utils/mount.c b/sys-utils/mount.c
index 377cafcf84905cb138480985e41e72a805438dd1..7f07ac0c957b63108b43f6f4c494ef6b10412966 100644 (file)
--- a/sys-utils/mount.c
+++ b/sys-utils/mount.c
@@ -303,19 +303,19 @@ static void success_message(struct libmnt_context *cxt)
 }
 
 #if defined(HAVE_LIBSELINUX) && defined(HAVE_SECURITY_GET_INITIAL_CONTEXT)
-# include <selinux/selinux.h>
-# include <selinux/context.h>
+# include "dl-selinux.h"
 
 static void selinux_warning(struct libmnt_context *cxt, const char *tgt)
 {
 
-       if (tgt && mnt_context_is_verbose(cxt) && is_selinux_enabled() > 0) {
+       if (tgt && mnt_context_is_verbose(cxt)
+           && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                char *raw = NULL, *def = NULL;
 
-               if (getfilecon(tgt, &raw) > 0
-                   && security_get_initial_context("file", &def) == 0) {
+               if (selinux_call(getfilecon)(tgt, &raw) > 0
+                   && selinux_call(security_get_initial_context)("file", &def) == 0) {
 
-               if (!selinux_file_context_cmp(raw, def))
+               if (!selinux_call(selinux_file_context_cmp)(raw, def))
                        printf(_(
        "mount: %s does not contain SELinux labels.\n"
        "       You just mounted a file system that supports labels which does not\n"
@@ -324,8 +324,8 @@ static void selinux_warning(struct libmnt_context *cxt, const char *tgt)
        "       this file system.  For more details see restorecon(8) and mount(8).\n"),
                                tgt);
                }
-               freecon(raw);
-               freecon(def);
+               selinux_call(freecon)(raw);
+               selinux_call(freecon)(def);
        }
 }
 #else

diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c
index 5fbef8746d54dd53aa461f3f70b48407cdaeb85c..1c51a6297026638dfafa2419f43c392e77e55cf3 100644 (file)
--- a/sys-utils/nsenter.c
+++ b/sys-utils/nsenter.c
@@ -37,7 +37,7 @@
 #endif
 
 #ifdef HAVE_LIBSELINUX
-# include <selinux/selinux.h>
+# include "dl-selinux.h"
 #endif
 
 #ifndef HAVE_ENVIRON_DECL
@@ -765,17 +765,17 @@ int main(int argc, char *argv[])
        }
 
 #ifdef HAVE_LIBSELINUX
-       if (selinux && is_selinux_enabled() > 0) {
+       if (selinux && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) {
                char *scon = NULL;
 
                if (!namespace_target_pid)
                        errx(EXIT_FAILURE, _("no target PID specified for --follow-context"));
-               if (getpidcon(namespace_target_pid, &scon) < 0)
+               if (selinux_call(getpidcon)(namespace_target_pid, &scon) < 0)
                        errx(EXIT_FAILURE, _("failed to get %d SELinux context"),
                                        (int) namespace_target_pid);
-               if (setexeccon(scon) < 0)
+               if (selinux_call(setexeccon)(scon) < 0)
                        errx(EXIT_FAILURE, _("failed to set exec context to '%s'"), scon);
-               freecon(scon);
+               selinux_call(freecon)(scon);
        }
 #endif