diff options
| author | Pádraig Brady <P@draigBrady.com> | 2014-01-02 16:40:58 +0000 |
|---|---|---|
| committer | Pádraig Brady <P@draigBrady.com> | 2014-01-13 12:52:26 +0000 |
| commit | 243128dbf0293be7b170dd47c8dbf3ed1834c093 (patch) | |
| tree | 55b105c10b08539b90491398275c7f62c35f130e /src | |
| parent | 5d7591d0edf0dd31c2daa195ee766c1383b89f4c (diff) | |
| download | coreutils-243128dbf0293be7b170dd47c8dbf3ed1834c093.tar.xz | |
copy: fix SELinux context preservation for existing directories
* src/copy.c (copy_internal): Use the global process context
to set the context of existing directories before they're populated.
This is more consistent with the new directory case, and fixes
a bug for existing directories where we erroneously set the
context to the last copied descendent, rather than to that of
the source directory itself.
* tests/cp/cp-a-selinux.sh: Add a test for this case.
* NEWS: Mention the fix.
* THANKS.in: Add reporter Michal Trunecka.
Diffstat (limited to 'src')
| -rw-r--r-- | src/copy.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/src/copy.c b/src/copy.c index 557d37b2b..3e4cbff7f 100644 --- a/src/copy.c +++ b/src/copy.c @@ -2408,6 +2408,17 @@ copy_internal (char const *src_name, char const *dst_name, else { omitted_permissions = 0; + + /* For directories, the process global context could be reset for + descendents, so use it to set the context for existing dirs here. + This will also give earlier indication of failure to set ctx. */ + if (x->set_security_context || x->preserve_security_context) + if (! set_file_security_ctx (dst_name, x->preserve_security_context, + false, x)) + { + if (x->require_preserve_context) + goto un_backup; + } } /* Decide whether to copy the contents of the directory. */ @@ -2598,7 +2609,7 @@ copy_internal (char const *src_name, char const *dst_name, /* With -Z or --preserve=context, set the context for existing files. Note this is done already for copy_reg() for reasons described therein. */ - if (!new_dst && !x->copy_as_regular + if (!new_dst && !x->copy_as_regular && !S_ISDIR (src_mode) && (x->set_security_context || x->preserve_security_context)) { if (! set_file_security_ctx (dst_name, x->preserve_security_context, |