From: Karel Zak Date: Mon, 13 Jul 2026 14:28:43 +0000 (+0200) Subject: tools: switch SELinux to runtime optional via dlopen X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=feaacdbb9f22d23e09b5ee29892063afe5dcc713;p=thirdparty%2Futil-linux.git tools: switch SELinux to runtime optional via dlopen Replace direct libselinux linking with runtime dlopen() using the shared dl-utils infrastructure. All tools that use SELinux functions now call them through selinux_call() macro and gracefully handle the case when libselinux is not installed at runtime. Affected tools: mkswap, chfn, chsh, lslogins, sulogin, vipw, namei, mount, nsenter, login. Signed-off-by: Karel Zak --- diff --git a/disk-utils/Makemodule.am b/disk-utils/Makemodule.am index 178bb9da6..069213ddf 100644 --- a/disk-utils/Makemodule.am +++ b/disk-utils/Makemodule.am @@ -71,10 +71,15 @@ mkswap_CFLAGS += -I$(ul_libblkid_incdir) mkswap_LDADD += libblkid.la endif if HAVE_SELINUX -mkswap_LDADD += $(SELINUX_LIBS) mkswap_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h \ lib/selinux-utils.c \ include/selinux-utils.h +mkswap_LDADD += -ldl +mkswap_CFLAGS += $(SELINUX_CFLAGS) endif endif # BUILD_MKSWAP diff --git a/disk-utils/meson.build b/disk-utils/meson.build index e576e3012..93603e462 100644 --- a/disk-utils/meson.build +++ b/disk-utils/meson.build @@ -18,7 +18,7 @@ mkswap_sources = files( ) + \ ismounted_c if lib_selinux.found() - mkswap_sources += selinux_utils_c + mkswap_sources += [dl_utils_c, dl_selinux_c, selinux_utils_c] endif mkswap_manadocs = files('mkswap.8.adoc') diff --git a/disk-utils/mkswap.c b/disk-utils/mkswap.c index a820a8815..2a081a97d 100644 --- a/disk-utils/mkswap.c +++ b/disk-utils/mkswap.c @@ -29,8 +29,7 @@ #include #include #ifdef HAVE_LIBSELINUX -# include -# include +# include "dl-selinux.h" # include "selinux-utils.h" #endif #ifdef HAVE_LINUX_FS_H @@ -803,12 +802,13 @@ int main(int argc, char **argv) deinit_signature_page(&ctl); #ifdef HAVE_LIBSELINUX - if ((ctl.file || S_ISREG(ctl.devstat.st_mode)) && is_selinux_enabled() > 0) { + if ((ctl.file || S_ISREG(ctl.devstat.st_mode)) + && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { const char *context_string; char *oldcontext; context_t newcontext; - if (fgetfilecon(ctl.fd, &oldcontext) < 0) { + if (selinux_call(fgetfilecon)(ctl.fd, &oldcontext) < 0) { if (errno != ENODATA) err(EXIT_FAILURE, _("%s: unable to obtain selinux file label"), @@ -819,20 +819,20 @@ int main(int argc, char **argv) _("%s: unable to obtain default selinux file label"), ctl.devname); } - if (!(newcontext = context_new(oldcontext))) + if (!(newcontext = selinux_call(context_new)(oldcontext))) errx(EXIT_FAILURE, _("unable to create new selinux context")); - if (context_type_set(newcontext, SELINUX_SWAPFILE_TYPE)) + if (selinux_call(context_type_set)(newcontext, SELINUX_SWAPFILE_TYPE)) errx(EXIT_FAILURE, _("couldn't compute selinux context")); - context_string = context_str(newcontext); + context_string = selinux_call(context_str)(newcontext); if (strcmp(context_string, oldcontext)!=0) { - if (fsetfilecon(ctl.fd, context_string) && errno != ENOTSUP) + if (selinux_call(fsetfilecon)(ctl.fd, context_string) && errno != ENOTSUP) err(EXIT_FAILURE, _("unable to relabel %s to %s"), ctl.devname, context_string); } - context_free(newcontext); - freecon(oldcontext); + selinux_call(context_free)(newcontext); + selinux_call(freecon)(oldcontext); } #endif /* diff --git a/login-utils/Makemodule.am b/login-utils/Makemodule.am index a82e4b70f..e08dd4cb9 100644 --- a/login-utils/Makemodule.am +++ b/login-utils/Makemodule.am @@ -43,7 +43,13 @@ if HAVE_LIBCRYPT sulogin_LDADD += -lcrypt endif if HAVE_SELINUX -sulogin_LDADD += $(SELINUX_LIBS) +sulogin_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +sulogin_LDADD += -ldl +sulogin_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS) endif check_PROGRAMS += test_consoles @@ -66,9 +72,6 @@ endif if HAVE_AUDIT login_LDADD += $(AUDIT_LIBS) endif -if HAVE_SELINUX -login_LDADD += $(SELINUX_LIBS) -endif endif # BUILD_LOGIN @@ -132,9 +135,14 @@ endif if HAVE_SELINUX chfn_chsh_sources += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h \ lib/selinux-utils.c \ include/selinux-utils.h -chfn_chsh_ldadd += $(SELINUX_LIBS) +chfn_chsh_ldadd += -ldl +chfn_chsh_cflags += $(SELINUX_CFLAGS) endif chfn_SOURCES = \ @@ -219,7 +227,13 @@ lslogins_SOURCES = \ lslogins_LDADD = $(LDADD) libcommon.la libcommon_logindefs.la libsmartcols.la lslogins_CFLAGS = $(AM_CFLAGS) -I$(ul_libsmartcols_incdir) if HAVE_SELINUX -lslogins_LDADD += $(SELINUX_LIBS) +lslogins_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +lslogins_LDADD += -ldl +lslogins_CFLAGS += $(SELINUX_CFLAGS) endif if HAVE_SYSTEMD lslogins_LDADD += $(SYSTEMD_LIBS) $(SYSTEMD_JOURNAL_LIBS) @@ -242,7 +256,13 @@ vipw_SOURCES = \ login-utils/setpwnam.h vipw_LDADD = $(LDADD) libcommon.la if HAVE_SELINUX -vipw_LDADD += $(SELINUX_LIBS) +vipw_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +vipw_LDADD += -ldl +vipw_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS) endif install-exec-hook-vipw:: cd $(DESTDIR)$(usrsbin_execdir) && ln -sf vipw vigr diff --git a/login-utils/chfn.c b/login-utils/chfn.c index efc58159e..251e9e50f 100644 --- a/login-utils/chfn.c +++ b/login-utils/chfn.c @@ -48,7 +48,7 @@ #include "pwdutils.h" #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" # include "selinux-utils.h" #endif @@ -462,7 +462,7 @@ int main(int argc, char **argv) #endif #ifdef HAVE_LIBSELINUX - if (is_selinux_enabled() > 0) { + if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { char *user_cxt = NULL; if (uid == 0 && !ul_selinux_has_access("passwd", "chfn", &user_cxt)) diff --git a/login-utils/chsh.c b/login-utils/chsh.c index 7effd3006..b2f983afa 100644 --- a/login-utils/chsh.c +++ b/login-utils/chsh.c @@ -47,7 +47,7 @@ #include "shells.h" #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" # include "selinux-utils.h" #endif @@ -219,7 +219,7 @@ int main(int argc, char **argv) #endif #ifdef HAVE_LIBSELINUX - if (is_selinux_enabled() > 0) { + if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { char *user_cxt = NULL; if (uid == 0 && !ul_selinux_has_access("passwd", "chsh", &user_cxt)) diff --git a/login-utils/lslogins.c b/login-utils/lslogins.c index fa69529f4..6837c76fd 100644 --- a/login-utils/lslogins.c +++ b/login-utils/lslogins.c @@ -39,7 +39,7 @@ #include #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" #endif #ifdef HAVE_LIBSYSTEMD @@ -1022,7 +1022,7 @@ static struct lslogins_user *get_user_info(struct lslogins_control *ctl, const c break; case COL_SELINUX: #ifdef HAVE_LIBSELINUX - if (!ctl->selinux_enabled || getcon(&user->context) != 0) + if (!ctl->selinux_enabled || selinux_call(getcon)(&user->context) != 0) user->context = NULL; #endif break; @@ -1512,7 +1512,8 @@ static void free_user(void *f) free(u->shell); free(u->pwd_status); #ifdef HAVE_LIBSELINUX - freecon(u->context); + if (u->context) + selinux_call(freecon)(u->context); #endif free(u); } @@ -1813,7 +1814,10 @@ int main(int argc, char *argv[]) case 'Z': { #ifdef HAVE_LIBSELINUX - int sl = is_selinux_enabled(); + int sl = 0; + + if (ul_dlopen_libselinux() == 0) + sl = selinux_call(is_selinux_enabled)(); if (sl < 0) warn(_("failed to request selinux state")); else diff --git a/login-utils/meson.build b/login-utils/meson.build index 251d8de46..d49d34293 100644 --- a/login-utils/meson.build +++ b/login-utils/meson.build @@ -35,8 +35,8 @@ else endif if lib_selinux.found() - chfn_chsh_sources += selinux_utils_c - chfn_chsh_deps += [lib_selinux] + chfn_chsh_sources += [dl_utils_c, dl_selinux_c, selinux_utils_c] + chfn_chsh_deps += lib_selinux_dlopen_deps endif chfn_sources = files( diff --git a/login-utils/sulogin.c b/login-utils/sulogin.c index 23f5164e6..7368be870 100644 --- a/login-utils/sulogin.c +++ b/login-utils/sulogin.c @@ -45,8 +45,7 @@ #endif #ifdef HAVE_LIBSELINUX -# include -# include +# include "dl-selinux.h" #endif #ifdef __linux__ @@ -107,8 +106,12 @@ static int is_selinux_enabled_cached(void) { static int cache = -1; - if (cache == -1) - cache = is_selinux_enabled(); + if (cache == -1) { + if (ul_dlopen_libselinux() == 0) + cache = selinux_call(is_selinux_enabled)(); + else + cache = 0; + } return cache; } @@ -127,12 +130,12 @@ static void compute_login_context(void) if (is_selinux_enabled_cached() == 0) goto cleanup; - if (getseuserbyname("root", &seuser, &level) == -1) { + if (selinux_call(getseuserbyname)("root", &seuser, &level) == -1) { warnx(_("failed to compute seuser")); goto cleanup; } - if (get_default_context_with_level(seuser, level, NULL, &login_context) == -1) { + if (selinux_call(get_default_context_with_level)(seuser, level, NULL, &login_context) == -1) { warnx(_("failed to compute default context")); goto cleanup; } @@ -152,22 +155,22 @@ static void tcinit_selinux(struct console *con) if (!login_context) return; - if (fgetfilecon(con->fd, &con->reset_tty_context) == -1) { + if (selinux_call(fgetfilecon)(con->fd, &con->reset_tty_context) == -1) { warn(_("failed to get context of terminal %s"), con->tty); return; } - tclass = string_to_security_class("chr_file"); + tclass = selinux_call(string_to_security_class)("chr_file"); if (tclass == 0) { warnx(_("security class chr_file not available")); - freecon(con->reset_tty_context); + selinux_call(freecon)(con->reset_tty_context); con->reset_tty_context = NULL; return; } - if (security_compute_relabel(login_context, con->reset_tty_context, tclass, &con->user_tty_context) == -1) { + if (selinux_call(security_compute_relabel)(login_context, con->reset_tty_context, tclass, &con->user_tty_context) == -1) { warnx(_("failed to compute relabel context of terminal")); - freecon(con->reset_tty_context); + selinux_call(freecon)(con->reset_tty_context); con->reset_tty_context = NULL; return; } @@ -926,12 +929,12 @@ static void sushell(struct passwd *pwd, struct console *con) #ifdef HAVE_LIBSELINUX if (is_selinux_enabled_cached() == 1) { if (con->user_tty_context) { - if (fsetfilecon(con->fd, con->user_tty_context) == -1) + if (selinux_call(fsetfilecon)(con->fd, con->user_tty_context) == -1) warn(_("failed to set context to %s for terminal %s"), con->user_tty_context, con->tty); } if (login_context) { - if (setexeccon(login_context) == -1) + if (selinux_call(setexeccon)(login_context) == -1) warn(_("failed to set exec context to %s"), login_context); } } @@ -963,10 +966,10 @@ static void tcreset_selinux(struct list_head *consoles) continue; if (!con->reset_tty_context) continue; - if (fsetfilecon(con->fd, con->reset_tty_context) == -1) + if (selinux_call(fsetfilecon)(con->fd, con->reset_tty_context) == -1) warn(_("failed to reset context to %s for terminal %s"), con->reset_tty_context, con->tty); - freecon(con->reset_tty_context); + selinux_call(freecon)(con->reset_tty_context); con->reset_tty_context = NULL; } } diff --git a/login-utils/vipw.c b/login-utils/vipw.c index 25d148685..093ba6082 100644 --- a/login-utils/vipw.c +++ b/login-utils/vipw.c @@ -70,7 +70,7 @@ #include "rpmatch.h" #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" #endif #define FILENAMELEN 67 @@ -149,16 +149,16 @@ static void pw_write(void) warn(_("%s: create a link to %s failed"), orig_file, tmp); #ifdef HAVE_LIBSELINUX - if (is_selinux_enabled() > 0) { + if (ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { char *passwd_context = NULL; int ret = 0; - if (getfilecon(orig_file, &passwd_context) < 0) { + if (selinux_call(getfilecon)(orig_file, &passwd_context) < 0) { warnx(_("Can't get context for %s"), orig_file); pw_error(orig_file, 1, 1); } - ret = setfilecon(tmp_file, passwd_context); - freecon(passwd_context); + ret = selinux_call(setfilecon)(tmp_file, passwd_context); + selinux_call(freecon)(passwd_context); if (ret != 0) { warnx(_("Can't set context for %s"), tmp_file); pw_error(tmp_file, 1, 1); diff --git a/meson.build b/meson.build index c4fe2c6f3..b349b18e7 100644 --- a/meson.build +++ b/meson.build @@ -486,10 +486,14 @@ lib_selinux = dependency( version : '>= 2.5', required : get_option('selinux')) conf.set('HAVE_LIBSELINUX', lib_selinux.found() ? 1 : false) +lib_selinux_compile_deps = [] +lib_selinux_dlopen_deps = [] if lib_selinux.found() have = cc.has_function('security_get_initial_context', dependencies : lib_selinux) conf.set('HAVE_SECURITY_GET_INITIAL_CONTEXT', have ? 1 : false) + lib_selinux_compile_deps = [lib_selinux.partial_dependency(compile_args : true, includes : true)] + lib_selinux_dlopen_deps = lib_selinux_compile_deps + [lib_dl] endif lib_magic = dependency( @@ -1226,13 +1230,13 @@ opt = get_option('build-lslogins') \ exe = executable( 'lslogins', 'login-utils/lslogins.c', + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common, lib_smartcols, lib_common_logindefs] + (build_liblastlog2 ? [lib_lastlog2] : []), - dependencies : [lib_selinux, - lib_systemd], + dependencies : [lib_systemd] + lib_selinux_dlopen_deps, install_dir : usrbin_exec_dir, install : opt, build_by_default : opt) @@ -1249,9 +1253,10 @@ exe = executable( 'vipw', 'login-utils/vipw.c', 'login-utils/setpwnam.h', + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common], - dependencies : [lib_selinux], + dependencies : lib_selinux_dlopen_deps, install_dir : usrbin_exec_dir, install : opt, build_by_default : opt) @@ -1969,10 +1974,11 @@ opt = get_option('build-mount').allowed() exe = executable( 'mount', mount_sources, + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common, lib_smartcols], - dependencies : [lib_selinux, mount_dep], + dependencies : [mount_dep] + lib_selinux_dlopen_deps, install_mode : 'rwsr-xr-x', install : opt, build_by_default : opt) @@ -2210,9 +2216,10 @@ opt = get_option('build-nsenter') \ exe = executable( 'nsenter', nsenter_sources, + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common], - dependencies : [lib_selinux], + dependencies : lib_selinux_dlopen_deps, install_dir : usrbin_exec_dir, install : opt, build_by_default : opt) @@ -2226,9 +2233,10 @@ opt = opt and 'nsenter' in static_programs exe = executable( 'nsenter.static', nsenter_sources, + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common], - dependencies : [lib_selinux], + dependencies : lib_selinux_dlopen_deps, install_dir : usrbin_exec_dir, install : opt, build_by_default : opt) @@ -2395,7 +2403,7 @@ exe = executable( include_directories : includes, link_with : [lib_common, lib_uuid], - dependencies: [blkid_dep, lib_selinux], + dependencies: [blkid_dep] + lib_selinux_dlopen_deps, install_dir : sbindir, install : true) if not is_disabler(exe) @@ -2889,8 +2897,7 @@ exe = executable( include_directories : includes, link_with : [lib_common, lib_common_logindefs, lib_common_shells], dependencies : [lib_pam, - lib_audit, - lib_selinux], + lib_audit], install : opt, build_by_default : opt) if opt and not is_disabler(exe) @@ -2904,10 +2911,10 @@ opt = get_option('build-sulogin') \ exe = executable( 'sulogin', sulogin_sources, + dl_utils_c, dl_selinux_c, include_directories : includes, link_with : [lib_common], - dependencies : [lib_crypt, - lib_selinux], + dependencies : [lib_crypt] + lib_selinux_dlopen_deps, install_dir : sbindir, install : opt, build_by_default : opt) @@ -3008,8 +3015,9 @@ opt = get_option('build-namei').allowed() exe = executable( 'namei', namei_sources, + dl_utils_c, dl_selinux_c, include_directories : includes, - dependencies : [lib_selinux], + dependencies : lib_selinux_dlopen_deps, install_dir : usrbin_exec_dir, install : opt, build_by_default : opt) diff --git a/misc-utils/Makemodule.am b/misc-utils/Makemodule.am index 4ff4a0090..fead1c2cd 100644 --- a/misc-utils/Makemodule.am +++ b/misc-utils/Makemodule.am @@ -69,7 +69,16 @@ usrbin_exec_PROGRAMS += namei MANPAGES += misc-utils/namei.1 dist_noinst_DATA += misc-utils/namei.1.adoc namei_SOURCES = misc-utils/namei.c lib/strutils.c lib/idcache.c -namei_LDADD = $(LDADD) $(SELINUX_LIBS) +namei_LDADD = $(LDADD) +if HAVE_SELINUX +namei_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +namei_LDADD += -ldl +namei_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS) +endif endif if BUILD_WHEREIS diff --git a/misc-utils/namei.c b/misc-utils/namei.c index d3898e564..1d2f7d5ee 100644 --- a/misc-utils/namei.c +++ b/misc-utils/namei.c @@ -32,7 +32,7 @@ #include #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" #endif #include "c.h" @@ -163,9 +163,10 @@ new_namei(struct namei *parent, const char *path, const char *fname, int lev) nm->name = xstrdup(fname); #ifdef HAVE_LIBSELINUX - /* Don't use is_selinux_enabled() here. We need info about a context - * also on systems where SELinux is (temporary) disabled */ - nm->context_len = lgetfilecon(path, &nm->context); + /* Don't check is_selinux_enabled() -- we want context info even + * on systems where SELinux is temporarily disabled */ + if (ul_dlopen_libselinux() == 0) + nm->context_len = selinux_call(lgetfilecon)(path, &nm->context); #endif if (lstat(path, &nm->st) != 0) { nm->noent = errno; diff --git a/sys-utils/Makemodule.am b/sys-utils/Makemodule.am index f98c81104..0ea8bd135 100644 --- a/sys-utils/Makemodule.am +++ b/sys-utils/Makemodule.am @@ -371,9 +371,18 @@ dist_noinst_DATA += \ sys-utils/fstab.5.adoc \ sys-utils/umount.8.adoc mount_SOURCES = sys-utils/mount.c -mount_LDADD = $(LDADD) libcommon.la libmount.la $(SELINUX_LIBS) +mount_LDADD = $(LDADD) libcommon.la libmount.la mount_CFLAGS = $(SUID_CFLAGS) $(AM_CFLAGS) -I$(ul_libmount_incdir) mount_LDFLAGS = $(SUID_LDFLAGS) $(AM_LDFLAGS) +if HAVE_SELINUX +mount_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +mount_LDADD += -ldl +mount_CFLAGS += $(SELINUX_CFLAGS) +endif umount_SOURCES = sys-utils/umount.c umount_LDADD = $(LDADD) libcommon.la libmount.la @@ -385,7 +394,7 @@ bin_PROGRAMS += mount.static mount_static_SOURCES = $(mount_SOURCES) mount_static_CFLAGS = $(mount_CFLAGS) mount_static_LDFLAGS = $(mount_LDFLAGS) -all-static -mount_static_LDADD = $(mount_LDADD) $(SELINUX_LIBS_STATIC) +mount_static_LDADD = $(mount_LDADD) endif if HAVE_STATIC_UMOUNT @@ -541,7 +550,16 @@ MANPAGES += sys-utils/nsenter.1 dist_noinst_DATA += sys-utils/nsenter.1.adoc nsenter_SOURCES = sys-utils/nsenter.c lib/exec_shell.c \ lib/caputils.c -nsenter_LDADD = $(LDADD) libcommon.la $(SELINUX_LIBS) +nsenter_LDADD = $(LDADD) libcommon.la +if HAVE_SELINUX +nsenter_SOURCES += \ + lib/dl-utils.c \ + include/dl-utils.h \ + lib/dl-selinux.c \ + include/dl-selinux.h +nsenter_LDADD += -ldl +nsenter_CFLAGS = $(AM_CFLAGS) $(SELINUX_CFLAGS) +endif if HAVE_STATIC_NSENTER usrbin_exec_PROGRAMS += nsenter.static diff --git a/sys-utils/mount.c b/sys-utils/mount.c index 377cafcf8..7f07ac0c9 100644 --- a/sys-utils/mount.c +++ b/sys-utils/mount.c @@ -303,19 +303,19 @@ static void success_message(struct libmnt_context *cxt) } #if defined(HAVE_LIBSELINUX) && defined(HAVE_SECURITY_GET_INITIAL_CONTEXT) -# include -# include +# include "dl-selinux.h" static void selinux_warning(struct libmnt_context *cxt, const char *tgt) { - if (tgt && mnt_context_is_verbose(cxt) && is_selinux_enabled() > 0) { + if (tgt && mnt_context_is_verbose(cxt) + && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { char *raw = NULL, *def = NULL; - if (getfilecon(tgt, &raw) > 0 - && security_get_initial_context("file", &def) == 0) { + if (selinux_call(getfilecon)(tgt, &raw) > 0 + && selinux_call(security_get_initial_context)("file", &def) == 0) { - if (!selinux_file_context_cmp(raw, def)) + if (!selinux_call(selinux_file_context_cmp)(raw, def)) printf(_( "mount: %s does not contain SELinux labels.\n" " You just mounted a file system that supports labels which does not\n" @@ -324,8 +324,8 @@ static void selinux_warning(struct libmnt_context *cxt, const char *tgt) " this file system. For more details see restorecon(8) and mount(8).\n"), tgt); } - freecon(raw); - freecon(def); + selinux_call(freecon)(raw); + selinux_call(freecon)(def); } } #else diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c index 5fbef8746..1c51a6297 100644 --- a/sys-utils/nsenter.c +++ b/sys-utils/nsenter.c @@ -37,7 +37,7 @@ #endif #ifdef HAVE_LIBSELINUX -# include +# include "dl-selinux.h" #endif #ifndef HAVE_ENVIRON_DECL @@ -765,17 +765,17 @@ int main(int argc, char *argv[]) } #ifdef HAVE_LIBSELINUX - if (selinux && is_selinux_enabled() > 0) { + if (selinux && ul_dlopen_libselinux() == 0 && selinux_call(is_selinux_enabled)() > 0) { char *scon = NULL; if (!namespace_target_pid) errx(EXIT_FAILURE, _("no target PID specified for --follow-context")); - if (getpidcon(namespace_target_pid, &scon) < 0) + if (selinux_call(getpidcon)(namespace_target_pid, &scon) < 0) errx(EXIT_FAILURE, _("failed to get %d SELinux context"), (int) namespace_target_pid); - if (setexeccon(scon) < 0) + if (selinux_call(setexeccon)(scon) < 0) errx(EXIT_FAILURE, _("failed to set exec context to '%s'"), scon); - freecon(scon); + selinux_call(freecon)(scon); } #endif