Skip to content

Commit 4c7a7a2

Browse files
pbrezinapbrezina
committed
backup-restore: ignore missing switchable-auth in backup
This is a new file and it can be missing from the backup. In this case we will just write an empty file (with authselect preambule). This is a corner case, an empty file will not break system authentication so this is fine.
1 parent 96d286f commit 4c7a7a2

File tree

4 files changed

+59
-43
lines changed

4 files changed

+59
-43
lines changed

‎src/lib/authselect_backup.c‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -240,17 +240,17 @@ static errno_t
240240
authselect_restore_system_configuration(const char *path)
241241
{
242242
struct selinux_safe_copy table[] = {
243-
{FILE_CONFIG, PATH_CONFIG_FILE, true},
244-
{FILE_SYSTEM, PATH_SYMLINK_SYSTEM, false},
245-
{FILE_PASSWORD, PATH_SYMLINK_PASSWORD, true},
246-
{FILE_FINGERPRINT, PATH_SYMLINK_FINGERPRINT, true},
247-
{FILE_SMARTCARD, PATH_SYMLINK_SMARTCARD, true},
248-
{FILE_SWITCHABLE, PATH_SYMLINK_SWITCHABLE, true},
249-
{FILE_POSTLOGIN, PATH_SYMLINK_POSTLOGIN, false},
250-
{FILE_NSSWITCH, PATH_SYMLINK_NSSWITCH, true},
251-
{FILE_DCONF_DB, PATH_SYMLINK_DCONF_DB, true},
252-
{FILE_DCONF_LOCK, PATH_SYMLINK_DCONF_LOCK, true},
253-
{NULL, NULL, false},
243+
{FILE_CONFIG, PATH_CONFIG_FILE, true, false},
244+
{FILE_SYSTEM, PATH_SYMLINK_SYSTEM, false, false},
245+
{FILE_PASSWORD, PATH_SYMLINK_PASSWORD, true, false},
246+
{FILE_FINGERPRINT, PATH_SYMLINK_FINGERPRINT, true, false},
247+
{FILE_SMARTCARD, PATH_SYMLINK_SMARTCARD, true, false},
248+
{FILE_SWITCHABLE, PATH_SYMLINK_SWITCHABLE, true, false},
249+
{FILE_POSTLOGIN, PATH_SYMLINK_POSTLOGIN, false, false},
250+
{FILE_NSSWITCH, PATH_SYMLINK_NSSWITCH, true, false},
251+
{FILE_DCONF_DB, PATH_SYMLINK_DCONF_DB, true, false},
252+
{FILE_DCONF_LOCK, PATH_SYMLINK_DCONF_LOCK, true, false},
253+
{NULL, NULL, false, false},
254254
};
255255
errno_t ret;
256256
int i;
@@ -279,17 +279,17 @@ static errno_t
279279
authselect_restore_authselect_configuration(const char *path)
280280
{
281281
struct selinux_safe_copy table[] = {
282-
{FILE_CONFIG, PATH_CONFIG_FILE, false},
283-
{FILE_SYSTEM, PATH_SYSTEM, false},
284-
{FILE_PASSWORD, PATH_PASSWORD, false},
285-
{FILE_FINGERPRINT, PATH_FINGERPRINT, false},
286-
{FILE_SMARTCARD, PATH_SMARTCARD, false},
287-
{FILE_SWITCHABLE, PATH_SWITCHABLE, false},
288-
{FILE_POSTLOGIN, PATH_POSTLOGIN, false},
289-
{FILE_NSSWITCH, PATH_NSSWITCH, false},
290-
{FILE_DCONF_DB, PATH_DCONF_DB, false},
291-
{FILE_DCONF_LOCK, PATH_DCONF_LOCK, false},
292-
{NULL, NULL, false},
282+
{FILE_CONFIG, PATH_CONFIG_FILE, false, false},
283+
{FILE_SYSTEM, PATH_SYSTEM, false, false},
284+
{FILE_PASSWORD, PATH_PASSWORD, false, false},
285+
{FILE_FINGERPRINT, PATH_FINGERPRINT, false, false},
286+
{FILE_SMARTCARD, PATH_SMARTCARD, false, false},
287+
{FILE_SWITCHABLE, PATH_SWITCHABLE, false, true},
288+
{FILE_POSTLOGIN, PATH_POSTLOGIN, false, false},
289+
{FILE_NSSWITCH, PATH_NSSWITCH, false, false},
290+
{FILE_DCONF_DB, PATH_DCONF_DB, false, false},
291+
{FILE_DCONF_LOCK, PATH_DCONF_LOCK, false, false},
292+
{NULL, NULL, false, false},
293293
};
294294
errno_t ret;
295295
int i;

‎src/lib/files/symlinks.c‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -163,16 +163,16 @@ errno_t
163163
authselect_symlinks_uninstall()
164164
{
165165
struct selinux_safe_copy table[] = {
166-
{PATH_SYSTEM, PATH_SYMLINK_SYSTEM, false},
167-
{PATH_PASSWORD, PATH_SYMLINK_PASSWORD, false},
168-
{PATH_FINGERPRINT, PATH_SYMLINK_FINGERPRINT, false},
169-
{PATH_SMARTCARD, PATH_SYMLINK_SMARTCARD, false},
170-
{PATH_SWITCHABLE, PATH_SYMLINK_SWITCHABLE, false},
171-
{PATH_POSTLOGIN, PATH_SYMLINK_POSTLOGIN, false},
172-
{PATH_NSSWITCH, PATH_SYMLINK_NSSWITCH, false},
173-
{PATH_DCONF_DB, PATH_SYMLINK_DCONF_DB, false},
174-
{PATH_DCONF_LOCK, PATH_SYMLINK_DCONF_LOCK, false},
175-
{NULL, NULL, false}
166+
{PATH_SYSTEM, PATH_SYMLINK_SYSTEM, false, false},
167+
{PATH_PASSWORD, PATH_SYMLINK_PASSWORD, false, false},
168+
{PATH_FINGERPRINT, PATH_SYMLINK_FINGERPRINT, false, false},
169+
{PATH_SMARTCARD, PATH_SYMLINK_SMARTCARD, false, false},
170+
{PATH_SWITCHABLE, PATH_SYMLINK_SWITCHABLE, false, false},
171+
{PATH_POSTLOGIN, PATH_SYMLINK_POSTLOGIN, false, false},
172+
{PATH_NSSWITCH, PATH_SYMLINK_NSSWITCH, false, false},
173+
{PATH_DCONF_DB, PATH_SYMLINK_DCONF_DB, false, false},
174+
{PATH_DCONF_LOCK, PATH_SYMLINK_DCONF_LOCK, false, false},
175+
{NULL, NULL, false, false}
176176
};
177177
errno_t ret;
178178
bool result;

‎src/lib/util/selinux.c‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@
2828
#include <sys/stat.h>
2929

3030
#include "common/common.h"
31+
#include "lib/constants.h"
3132
#include "lib/util/file.h"
33+
#include "lib/util/template.h"
3234
#include "lib/util/selinux.h"
3335
#include "lib/util/string_array.h"
3436

@@ -383,23 +385,34 @@ selinux_copy_files_safely(struct selinux_safe_copy *table,
383385
}
384386

385387
if (file_exists(table[i].source) == ENOENT) {
386-
if (!table[i].can_unlink) {
388+
if (table[i].write_empty_if_missing) {
389+
INFO("File [%s] does not exist", table[i].source);
390+
INFO("Writing empty temporary file for [%s]",
391+
table[i].destination);
392+
ret = template_write_temporary(table[i].destination, "",
393+
AUTHSELECT_FILE_MODE,
394+
&tmpfiles[i]);
395+
if (ret != EOK) {
396+
goto done;
397+
}
398+
} else if (!table[i].can_unlink) {
387399
ERROR("File [%s] should exist but is missing. It is not safe to "
388400
"delete [%s]. Aborting.", table[i].source,
389401
table[i].destination);
390402
ret = EPERM;
391403
goto done;
404+
} else {
405+
/* destination will be removed later */
406+
INFO("File [%s] does not exist", table[i].source);
407+
tmpfiles[i] = NULL;
408+
}
409+
} else {
410+
INFO("Writing temporary file for [%s]", table[i].destination);
411+
ret = selinux_mkstemp_copy(table[i].source, dirs[i], names[i],
412+
dir_mode, keep_secontext, &tmpfiles[i]);
413+
if (ret != EOK) {
414+
goto done;
392415
}
393-
INFO("File [%s] does not exist", table[i].source);
394-
tmpfiles[i] = NULL;
395-
continue;
396-
}
397-
398-
INFO("Writing temporary file for [%s]", table[i].destination);
399-
ret = selinux_mkstemp_copy(table[i].source, dirs[i], names[i],
400-
dir_mode, keep_secontext, &tmpfiles[i]);
401-
if (ret != EOK) {
402-
goto done;
403416
}
404417
}
405418

‎src/lib/util/selinux.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,9 @@ struct selinux_safe_copy {
8686

8787
/* Unlink destination if source file does not exist. */
8888
bool can_unlink;
89+
90+
/* Write an empty file if the source is missing. */
91+
bool write_empty_if_missing;
8992
};
9093

9194
/**

0 commit comments

Comments
 (0)