clearlinux/systemd-stable
2
0
Fork 0
mirror of https://github.com/clearlinux/systemd-stable.git synced 2026-09-06 21:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

selinux: figure out selinux context applied on exec() before closing all fds

Browse Source 
We need original socket_fd around otherwise mac_selinux_get_child_mls_label
fails with -EINVAL return code. Also don't call setexeccon twice but rather pass
context value of SELinuxContext option as an extra argument.

(cherry picked from commit 9008e1ac92)
This commit is contained in:
Michal Sekletar
2015-01-15 22:18:11 -05:00
committed by Zbigniew Jędrzejewski-Szmek
parent 6c3f564c05
commit a44b8d63d4
3 changed files with 17 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/execute.c
+14 -17
View File
@@ -1236,6 +1236,7 @@ static int exec_child(ExecCommand *command,
int *error) {
_cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
_cleanup_free_ char *mac_selinux_context_net = NULL;
const char *username = NULL, *home = NULL, *shell = NULL;
unsigned n_dont_close = 0;
int dont_close[n_fds + 4];
@@ -1581,6 +1582,16 @@ static int exec_child(ExecCommand *command,
}
}
#ifdef HAVE_SELINUX
if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
err = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
if (err < 0) {
*error = EXIT_SELINUX_CONTEXT;
return err;
}
}
#endif
/* We repeat the fd closing here, to make sure that
* nothing is leaked from the PAM modules. Note that
* we are more aggressive this time since socket_fd
@@ -1670,24 +1681,10 @@ static int exec_child(ExecCommand *command,
#ifdef HAVE_SELINUX
if (mac_selinux_use()) {
if (context->selinux_context) {
err = setexeccon(context->selinux_context);
if (err < 0 && !context->selinux_context_ignore) {
*error = EXIT_SELINUX_CONTEXT;
return err;
}
}
char *exec_context = mac_selinux_context_net ?: context->selinux_context;
if (params->selinux_context_net && socket_fd >= 0) {
_cleanup_free_ char *label = NULL;
err = mac_selinux_get_child_mls_label(socket_fd, command->path, &label);
if (err < 0) {
*error = EXIT_SELINUX_CONTEXT;
return err;
}
err = setexeccon(label);
if (exec_context) {
err = setexeccon(exec_context);
if (err < 0) {
*error = EXIT_SELINUX_CONTEXT;
return err;
src/shared/selinux-util.c
+2 -6
View File
@@ -233,7 +233,7 @@ int mac_selinux_get_our_label(char **label) {
return r;
}
int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, char **label) {
int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *exec_label, char **label) {
int r = -EOPNOTSUPP;
#ifdef HAVE_SELINUX
@@ -257,11 +257,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, char **label
if (r < 0)
return -errno;
r = getexeccon(&fcon);
if (r < 0)
return -errno;
if (!fcon) {
if (!exec_label) {
/* If there is no context set for next exec let's use context
of target executable */
r = getfilecon(exe, &fcon);
src/shared/selinux-util.h
+1 -1
View File
@@ -36,7 +36,7 @@ int mac_selinux_apply(const char *path, const char *label);
int mac_selinux_get_create_label_from_exe(const char *exe, char **label);
int mac_selinux_get_our_label(char **label);
int mac_selinux_get_child_mls_label(int socket_fd, const char *exec, char **label);
int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *exec_label, char **label);
void mac_selinux_free(char *label);
int mac_selinux_create_file_prepare(const char *path, mode_t mode);