func FormatMountLabel(src string, mountLabel string) string { if selinux.SelinuxEnabled() && mountLabel != "" { switch src { case "": src = fmt.Sprintf("%s,context=%s", src, mountLabel) default: src = fmt.Sprintf("context=%s", mountLabel) } } return src }
func testSetfilecon(t *testing.T) { if selinux.SelinuxEnabled() { tmp := "selinux_test" out, _ := os.OpenFile(tmp, os.O_WRONLY, 0) out.Close() err := selinux.Setfilecon(tmp, "system_u:object_r:bin_t:s0") if err != nil { t.Log("Setfilecon failed") t.Fatal(err) } os.Remove(tmp) } }
func TestSELinux(t *testing.T) { var ( err error plabel, flabel string ) if selinux.SelinuxEnabled() { t.Log("Enabled") plabel, flabel = selinux.GetLxcContexts() t.Log(plabel) t.Log(flabel) plabel, flabel = selinux.GetLxcContexts() t.Log(plabel) t.Log(flabel) t.Log("getenforce ", selinux.SelinuxGetEnforce()) t.Log("getenforcemode ", selinux.SelinuxGetEnforceMode()) pid := os.Getpid() t.Log("PID:%d MCS:%s\n", pid, selinux.IntToMcs(pid, 1023)) t.Log(selinux.Getcon()) t.Log(selinux.Getfilecon("/etc/passwd")) err = selinux.Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0") if err == nil { t.Log(selinux.Getfscreatecon()) } else { t.Log("setfscreatecon failed", err) t.Fatal(err) } err = selinux.Setfscreatecon("") if err == nil { t.Log(selinux.Getfscreatecon()) } else { t.Log("setfscreatecon failed", err) t.Fatal(err) } t.Log(selinux.Getpidcon(1)) t.Log(selinux.GetSelinuxMountPoint()) } else { t.Log("Disabled") } }
func GenLabels(options string) (string, string, error) { if !selinux.SelinuxEnabled() { return "", "", nil } var err error processLabel, mountLabel := selinux.GetLxcContexts() if processLabel != "" { var ( s = strings.Fields(options) l = len(s) ) if l > 0 { pcon := selinux.NewContext(processLabel) for i := 0; i < l; i++ { o := strings.Split(s[i], "=") pcon[o[0]] = o[1] } processLabel = pcon.Get() mountLabel, err = selinux.CopyLevel(processLabel, mountLabel) } } return processLabel, mountLabel, err }
func Init() { selinux.SelinuxEnabled() }
func GetPidCon(pid int) (string, error) { if !selinux.SelinuxEnabled() { return "", nil } return selinux.Getpidcon(pid) }
func SetFileLabel(path string, fileLabel string) error { if selinux.SelinuxEnabled() && fileLabel != "" { return selinux.Setfilecon(path, fileLabel) } return nil }
func GetProcessLabel() (string, error) { if selinux.SelinuxEnabled() { return selinux.Getexeccon() } return "", nil }
func SetProcessLabel(processLabel string) error { if selinux.SelinuxEnabled() { return selinux.Setexeccon(processLabel) } return nil }