C///

\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5�\D6?\BD�\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2� \00$\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4�\E9\F2�\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// package selinux /* The selinux package is a go bindings to libselinux required to add selinux support to docker. Author Dan Walsh Used some ideas/code from the go-ini packages https://github.com/vaughan0 By Vaughan Newton */ // #cgo pkg-config: libselinux // #include // #include import "C" import ( "bufio" "crypto/rand" "encoding/binary" "fmt" "io" "os" "path" "path/filepath" "regexp" "strings" "unsafe" ) var ( assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`) mcsList = make(map[string]bool) ) func Matchpathcon(path string, mode os.FileMode) (string, error) { var con C.security_context_t var scon string rc, err := C.matchpathcon(C.CString(path), C.mode_t(mode), &con) if rc == 0 { scon = C.GoString(con) C.free(unsafe.Pointer(con)) } return scon, err } func Setfilecon(path, scon string) (int, error) { rc, err := C.lsetfilecon(C.CString(path), C.CString(scon)) return int(rc), err } func Getfilecon(path string) (string, error) { var scon C.security_context_t var fcon string rc, err := C.lgetfilecon(C.CString(path), &scon) if rc >= 0 { fcon = C.GoString(scon) err = nil } return fcon, err } func Setfscreatecon(scon string) (int, error) { var ( rc C.int err error ) if scon != "" { rc, err = C.setfscreatecon(C.CString(scon)) } else { rc, err = C.setfscreatecon(nil) } return int(rc), err } func Getfscreatecon() (string, error) { var scon C.security_context_t var fcon string rc, err := C.getfscreatecon(&scon) if rc >= 0 { fcon = C.GoString(scon) err = nil C.freecon(scon) } return fcon, err } func Getcon() string { var pcon C.security_context_t C.getcon(&pcon) scon := C.GoString(pcon) C.freecon(pcon) return scon } func Getpidcon(pid int) (string, error) { var pcon C.security_context_t var scon string rc, err := C.getpidcon(C.pid_t(pid), &pcon) if rc >= 0 { scon = C.GoString(pcon) C.freecon(pcon) err = nil } return scon, err } func Getpeercon(socket int) (string, error) { var pcon C.security_context_t var scon string rc, err := C.getpeercon(C.int(socket), &pcon) if rc >= 0 { scon = C.GoString(pcon) C.freecon(pcon) err = nil } return scon, err } func Setexeccon(scon string) error { var val *C.char if !SelinuxEnabled() { return nil } if scon != "" { val = C.CString(scon) } else { val = nil } _, err := C.setexeccon(val) return err } type Context struct { con []string } func (c *Context) SetUser(user string) { c.con[0] = user } func (c *Context) GetUser() string { return c.con[0] } func (c *Context) SetRole(role string) { c.con[1] = role } func (c *Context) GetRole() string { return c.con[1] } func (c *Context) SetType(setype string) { c.con[2] = setype } func (c *Context) GetType() string { return c.con[2] } func (c *Context) SetLevel(mls string) { c.con[3] = mls } func (c *Context) GetLevel() string { return c.con[3] } func (c *Context) Get() string { return strings.Join(c.con, ":") } func (c *Context) Set(scon string) { c.con = strings.SplitN(scon, ":", 4) } func NewContext(scon string) Context { var con Context con.Set(scon) return con } func SelinuxEnabled() bool { b := C.is_selinux_enabled() if b > 0 { return true } return false } const ( Enforcing = 1 Permissive = 0 Disabled = -1 ) func SelinuxGetEnforce() int { return int(C.security_getenforce()) } func SelinuxGetEnforceMode() int { var enforce C.int C.selinux_getenforcemode(&enforce) return int(enforce) } func mcsAdd(mcs string) { mcsList[mcs] = true } func mcsDelete(mcs string) { mcsList[mcs] = false } func mcsExists(mcs string) bool { return mcsList[mcs] } func IntToMcs(id int, catRange uint32) string { if (id < 1) || (id > 523776) { return "" } SETSIZE := int(catRange) TIER := SETSIZE ORD := id for ORD > TIER { ORD = ORD - TIER TIER -= 1 } TIER = SETSIZE - TIER ORD = ORD + TIER return fmt.Sprintf("s0:c%d,c%d", TIER, ORD) } func uniqMcs(catRange uint32) string { var n uint32 var c1, c2 uint32 var mcs string for { binary.Read(rand.Reader, binary.LittleEndian, &n) c1 = n % catRange binary.Read(rand.Reader, binary.LittleEndian, &n) c2 = n % catRange if c1 == c2 { continue } else { if c1 > c2 { t := c1 c1 = c2 c2 = t } } mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2) if mcsExists(mcs) { continue } mcsAdd(mcs) break } return mcs } func freeContext(processLabel string) { var scon Context scon = NewContext(processLabel) mcsDelete(scon.GetLevel()) } func GetLxcContexts() (processLabel string, fileLabel string) { var val, key string var bufin *bufio.Reader if !SelinuxEnabled() { return } lxcPath := C.GoString(C.selinux_lxc_contexts_path()) fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0" processLabel = "system_u:system_r:svirt_lxc_net_t:s0" in, err := os.Open(lxcPath) if err != nil { goto exit } defer in.Close() bufin = bufio.NewReader(in) for done := false; !done; { var line string if line, err = bufin.ReadString('\n'); err != nil { if err == io.EOF { done = true } else { goto exit } } line = strings.TrimSpace(line) if len(line) == 0 { // Skip blank lines continue } if line[0] == ';' || line[0] == '#' { // Skip comments continue } if groups := assignRegex.FindStringSubmatch(line); groups != nil { key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2]) if key == "process" { processLabel = strings.Trim(val, "\"") } if key == "file" { fileLabel = strings.Trim(val, "\"") } } } exit: var scon Context mcs := IntToMcs(os.Getpid(), 1024) scon = NewContext(processLabel) scon.SetLevel(mcs) processLabel = scon.Get() scon = NewContext(fileLabel) scon.SetLevel(mcs) fileLabel = scon.Get() return processLabel, fileLabel } func CopyLevel(src, dest string) (string, error) { if !SelinuxEnabled() { return "", nil } if src == "" { return "", nil } rc, err := C.security_check_context(C.CString(src)) if rc != 0 { return "", err } rc, err = C.security_check_context(C.CString(dest)) if rc != 0 { return "", err } scon := NewContext(src) tcon := NewContext(dest) tcon.SetLevel(scon.GetLevel()) return tcon.Get(), nil } func RestoreCon(fpath string, recurse bool)