1 #include <unistd.h> 2 #include <sys/types.h> 3 #include <fcntl.h> 4 #include <stdio.h> 5 #include <stdlib.h> 6 #include <errno.h> 7 #include <string.h> 8 #include <ctype.h> 9 #include <selinux/selinux.h> 10 #include <selinux/get_context_list.h> 11 12 static __attribute__ ((__noreturn__)) void usage(const char *name, const char *detail, int rc) 13 { 14 fprintf(stderr, "usage: %s [-l level] [-s service] user [fromcon]\n", name); 15 if (detail) 16 fprintf(stderr, "%s: %s\n", name, detail); 17 exit(rc); 18 } 19 20 int main(int argc, char **argv) 21 { 22 char * usercon = NULL, *cur_context = NULL; 23 char *user = NULL, *level = NULL, *role=NULL, *seuser=NULL, *dlevel=NULL; 24 char *service = NULL; 25 int ret, opt; 26 int verbose = 0; 27 28 while ((opt = getopt(argc, argv, "l:r:s:v")) > 0) { 29 switch (opt) { 30 case 'l': 31 level = strdup(optarg); 32 break; 33 case 'r': 34 role = strdup(optarg); 35 break; 36 case 's': 37 service = strdup(optarg); 38 break; 39 case 'v': 40 verbose = 1; 41 break; 42 default: 43 usage(argv[0], "invalid option", 1); 44 } 45 } 46 47 if (((argc - optind) < 1) || ((argc - optind) > 2)) 48 usage(argv[0], "invalid number of arguments", 2); 49 50 /* If selinux isn't available, bail out. */ 51 if (!is_selinux_enabled()) { 52 fprintf(stderr, 53 "%s may be used only on a SELinux kernel.\n", argv[0]); 54 return 1; 55 } 56 57 user = argv[optind]; 58 59 /* If a context wasn't passed, use the current context. */ 60 if (((argc - optind) < 2)) { 61 if (getcon(&cur_context) < 0) { 62 fprintf(stderr, "Couldn't get current context.\n"); 63 return 2; 64 } 65 } else 66 cur_context = argv[optind + 1]; 67 68 if ((ret = getseuser(user, service, &seuser, &dlevel)) == 0) { 69 if (! level) level=dlevel; 70 if (role != NULL && role[0]) 71 ret=get_default_context_with_rolelevel(seuser, role, level,cur_context,&usercon); 72 else 73 ret=get_default_context_with_level(seuser, level, cur_context,&usercon); 74 } 75 if (ret < 0) 76 perror(argv[0]); 77 else { 78 if (verbose) { 79 printf("%s: %s from %s %s %s %s -> %s\n", argv[0], user, cur_context, seuser, role, level, usercon); 80 } else { 81 printf("%s\n", usercon); 82 } 83 } 84 85 free(role); 86 free(seuser); 87 if (level != dlevel) free(level); 88 free(dlevel); 89 free(usercon); 90 91 return ret >= 0; 92 } 93
