daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
803fb7
From 2d30914ae86e9f40c02d80e0ef5c01e54efbbbc9 Mon Sep 17 00:00:00 2001
803fb7
From: Michal Sekletar <msekleta@redhat.com>
803fb7
Date: Tue, 1 Sep 2015 16:02:58 +0200
803fb7
Subject: [PATCH] selinux: always use *_raw API from libselinux
803fb7
803fb7
When mcstransd* is running non-raw functions will return translated SELinux
803fb7
context. Problem is that libselinux will cache this information and in the
803fb7
future it will return same context even though mcstransd maybe not running at
803fb7
that time. If you then check with such context against SELinux policy then
803fb7
selinux_check_access may fail depending on whether mcstransd is running or not.
803fb7
803fb7
To workaround this problem/bug in libselinux, we should always get raw context
803fb7
instead. Most users will not notice because they don't use MCS/MLS policy
803fb7
anyway. Others will most likely not notice as well because result of access
803fb7
check is logged only in debug mode.
803fb7
803fb7
* Service which translates labels to human readable form
803fb7
803fb7
Resolves: #1256888
803fb7
---
803fb7
 src/core/selinux-access.c |  4 ++--
803fb7
 src/shared/selinux-util.c | 10 +++++-----
803fb7
 2 files changed, 7 insertions(+), 7 deletions(-)
803fb7
803fb7
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
803fb7
index f11247c09..297372d12 100644
803fb7
--- a/src/core/selinux-access.c
803fb7
+++ b/src/core/selinux-access.c
803fb7
@@ -219,13 +219,13 @@ int mac_selinux_generic_access_check(
803fb7
         if (path && !system) {
803fb7
                 /* Get the file context of the unit file */
803fb7
 
803fb7
-                r = getfilecon(path, &fcon);
803fb7
+                r = getfilecon_raw(path, &fcon);
803fb7
                 if (r < 0) {
803fb7
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
803fb7
                         goto finish;
803fb7
                 }
803fb7
         } else {
803fb7
-                r = getcon(&fcon);
803fb7
+                r = getcon_raw(&fcon);
803fb7
                 if (r < 0) {
803fb7
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
803fb7
                         goto finish;
803fb7
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
803fb7
index a46ddf849..4c2e1b0b4 100644
803fb7
--- a/src/shared/selinux-util.c
803fb7
+++ b/src/shared/selinux-util.c
803fb7
@@ -200,11 +200,11 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
803fb7
         if (!mac_selinux_use())
803fb7
                 return -EOPNOTSUPP;
803fb7
 
803fb7
-        r = getcon(&mycon);
803fb7
+        r = getcon_raw(&mycon);
803fb7
         if (r < 0)
803fb7
                 return -errno;
803fb7
 
803fb7
-        r = getfilecon(exe, &fcon);
803fb7
+        r = getfilecon_raw(exe, &fcon);
803fb7
         if (r < 0)
803fb7
                 return -errno;
803fb7
 
803fb7
@@ -226,7 +226,7 @@ int mac_selinux_get_our_label(char **label) {
803fb7
         if (!mac_selinux_use())
803fb7
                 return -EOPNOTSUPP;
803fb7
 
803fb7
-        r = getcon(label);
803fb7
+        r = getcon_raw(label);
803fb7
         if (r < 0)
803fb7
                 return -errno;
803fb7
 #endif
803fb7
@@ -250,7 +250,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
803fb7
         if (!mac_selinux_use())
803fb7
                 return -EOPNOTSUPP;
803fb7
 
803fb7
-        r = getcon(&mycon);
803fb7
+        r = getcon_raw(&mycon);
803fb7
         if (r < 0)
803fb7
                 return -errno;
803fb7
 
803fb7
@@ -261,7 +261,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
803fb7
         if (!exec_label) {
803fb7
                 /* If there is no context set for next exec let's use context
803fb7
                    of target executable */
803fb7
-                r = getfilecon(exe, &fcon);
803fb7
+                r = getfilecon_raw(exe, &fcon);
803fb7
                 if (r < 0)
803fb7
                         return -errno;
803fb7
         }