1#include <unistd.h>
2#include <sys/types.h>
3#include <fcntl.h>
4#include <stdio.h>
5#include <stdlib.h>
6#include <errno.h>
7#include <string.h>
8#include <ctype.h>
9#include <selinux/selinux.h>
10#include <selinux/get_context_list.h>
11
12static __attribute__ ((__noreturn__)) void usage(const char *name, const char *detail, int rc)
13{
14	fprintf(stderr, "usage:  %s [-l level] [-s service] user [fromcon]\n", name);
15	if (detail)
16		fprintf(stderr, "%s:  %s\n", name, detail);
17	exit(rc);
18}
19
20int main(int argc, char **argv)
21{
22	char * usercon = NULL, *cur_context = NULL;
23	char *user = NULL, *level = NULL, *role=NULL, *seuser=NULL, *dlevel=NULL;
24	char *service = NULL;
25	int ret, opt;
26	int verbose = 0;
27
28	while ((opt = getopt(argc, argv, "l:r:s:v")) > 0) {
29		switch (opt) {
30		case 'l':
31			level = strdup(optarg);
32			break;
33		case 'r':
34			role = strdup(optarg);
35			break;
36		case 's':
37			service = strdup(optarg);
38			break;
39		case 'v':
40			verbose = 1;
41			break;
42		default:
43			usage(argv[0], "invalid option", 1);
44		}
45	}
46
47	if (((argc - optind) < 1) || ((argc - optind) > 2))
48		usage(argv[0], "invalid number of arguments", 2);
49
50	/* If selinux isn't available, bail out. */
51	if (!is_selinux_enabled()) {
52		fprintf(stderr,
53			"%s may be used only on a SELinux kernel.\n", argv[0]);
54		return 1;
55	}
56
57	user = argv[optind];
58
59	/* If a context wasn't passed, use the current context. */
60	if (((argc - optind) < 2)) {
61		if (getcon(&cur_context) < 0) {
62			fprintf(stderr, "Couldn't get current context.\n");
63			return 2;
64		}
65	} else
66		cur_context = argv[optind + 1];
67
68	if ((ret = getseuser(user, service, &seuser, &dlevel)) == 0) {
69		if (! level) level=dlevel;
70		if (role != NULL && role[0])
71			ret=get_default_context_with_rolelevel(seuser, role, level,cur_context,&usercon);
72		else
73			ret=get_default_context_with_level(seuser, level, cur_context,&usercon);
74	}
75	if (ret < 0)
76		perror(argv[0]);
77	else {
78		if (verbose) {
79			printf("%s: %s from %s %s %s %s -> %s\n", argv[0], user, cur_context, seuser, role, level, usercon);
80		} else {
81			printf("%s\n", usercon);
82		}
83	}
84
85	free(role);
86	free(seuser);
87	if (level != dlevel) free(level);
88	free(dlevel);
89	free(usercon);
90
91	return ret >= 0;
92}
93