Fix read-only LMDB lookup DBI lifetime

The read-only fapolicyd-cli --check-path setup opened the active LMDB named database and then aborted the transaction. LMDB keeps DBI handles opened by mdb_dbi_open() private to the opening transaction until that transaction commits, so the aborted setup transaction could invalidate readonly_lookup_dbi and make later cursor opens fail.

Commit the read-only setup transaction after opening the active DBI, and keep abort handling for setup failures. This preserves the private read-only environment while making the DBI usable by subsequent read-only lookup transactions.

Add a trustdb_lmdb_test regression that publishes a temporary trust record, closes the writable test environment, starts the CLI read-only lookup state, and verifies the trusted path is found through a later transaction.

Author: stevegrubb

src/library/database.c

@@ -5078,18 +5078,25 @@ int database_readonly_lookup_start(void)
 	if (rc)
 		goto out_abort;
 
+	/*
+	 * LMDB DBI handles opened in a transaction stay private until that
+	 * transaction commits. Aborting here would close readonly_lookup_dbi
+	 * before check_trust_database_readonly() starts its lookup transaction.
+	 */
+	rc = mdb_txn_commit(txn);
+	if (rc)
+		goto error;
+
 	MDB_maxkeysize = mdb_env_get_maxkeysize(readonly_lookup_env);
 	lib_symlink = is_link("/lib");
 	lib64_symlink = is_link("/lib64");
 	bin_symlink = is_link("/bin");
 	sbin_symlink = is_link("/sbin");
 	readonly_lookup_open = 1;
+	return 0;
 
 out_abort:
 	mdb_txn_abort(txn);
-	if (rc)
-		goto error;
-	return 0;
 
 error:
 	database_readonly_lookup_finish();

src/tests/trustdb_lmdb_test.c

@@ -697,6 +697,46 @@ static int test_lmdb_readonly_probe_does_not_break_live_env(void)
 	return 0;
 }
 
+/*
+ * test_lmdb_readonly_lookup_keeps_dbi_valid - Guard CLI read-only lookups.
+ *
+ * Returns 0 when the DBI opened during read-only lookup setup remains usable
+ * by later lookup transactions.
+ */
+static int test_lmdb_readonly_lookup_keeps_dbi_valid(void)
+{
+	conf_t cfg;
+	char dir[128];
+	long entries = 0;
+	int rc;
+	const char *trusted_path = "/usr/bin/readonly-dbi";
+	const char *digest =
+		"abababababababababababababababababababababababababababababababab";
+	char payload[512];
+
+	rc = with_temp_db(dir, sizeof(dir), &cfg);
+	CHECK(rc == 0, 250, "[ERROR:250] failed to open temporary LMDB");
+
+	snprintf(payload, sizeof(payload), "%s " DATA_FORMAT "\n",
+		 trusted_path, SRC_FILE_DB, (size_t)789, digest);
+	rc = import_records(payload, &entries);
+	CHECK(rc == 0 && entries == 1, 251,
+	      "[ERROR:251] readonly lookup record import failed");
+
+	database_close_for_tests();
+
+	rc = database_readonly_lookup_start();
+	CHECK(rc == 0, 252, "[ERROR:252] readonly lookup start failed");
+	CHECK(check_trust_database_readonly(trusted_path, NULL, -1) == 1, 253,
+	      "[ERROR:253] readonly lookup could not read trusted path");
+
+	database_readonly_lookup_finish();
+	database_set_location(NULL, NULL);
+	CHECK(remove_lmdb_files(dir) == 0, 254,
+	      "[ERROR:254] readonly lookup cleanup failed");
+	return 0;
+}
+
 static int test_lmdb_chunked_import(void)
 {
 	const unsigned int record_count = 4105;
@@ -1538,6 +1578,10 @@ int main(void)
 	if (rc)
 		return rc;
 
+	rc = test_lmdb_readonly_lookup_keeps_dbi_valid();
+	if (rc)
+		return rc;
+
 	rc = test_lmdb_chunked_import();
 	if (rc)
 		return rc;