daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
1ff636
From 2d30914ae86e9f40c02d80e0ef5c01e54efbbbc9 Mon Sep 17 00:00:00 2001
1ff636
From: Michal Sekletar <msekleta@redhat.com>
1ff636
Date: Tue, 1 Sep 2015 16:02:58 +0200
1ff636
Subject: [PATCH] selinux: always use *_raw API from libselinux
1ff636
1ff636
When mcstransd* is running non-raw functions will return translated SELinux
1ff636
context. Problem is that libselinux will cache this information and in the
1ff636
future it will return same context even though mcstransd maybe not running at
1ff636
that time. If you then check with such context against SELinux policy then
1ff636
selinux_check_access may fail depending on whether mcstransd is running or not.
1ff636
1ff636
To workaround this problem/bug in libselinux, we should always get raw context
1ff636
instead. Most users will not notice because they don't use MCS/MLS policy
1ff636
anyway. Others will most likely not notice as well because result of access
1ff636
check is logged only in debug mode.
1ff636
1ff636
* Service which translates labels to human readable form
1ff636
1ff636
Resolves: #1256888
1ff636
---
1ff636
 src/core/selinux-access.c |  4 ++--
1ff636
 src/shared/selinux-util.c | 10 +++++-----
1ff636
 2 files changed, 7 insertions(+), 7 deletions(-)
1ff636
1ff636
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
181b3f
index f11247c09..297372d12 100644
1ff636
--- a/src/core/selinux-access.c
1ff636
+++ b/src/core/selinux-access.c
1ff636
@@ -219,13 +219,13 @@ int mac_selinux_generic_access_check(
1ff636
         if (path && !system) {
1ff636
                 /* Get the file context of the unit file */
1ff636
 
1ff636
-                r = getfilecon(path, &fcon);
1ff636
+                r = getfilecon_raw(path, &fcon);
1ff636
                 if (r < 0) {
1ff636
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
1ff636
                         goto finish;
1ff636
                 }
1ff636
         } else {
1ff636
-                r = getcon(&fcon);
1ff636
+                r = getcon_raw(&fcon);
1ff636
                 if (r < 0) {
1ff636
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
1ff636
                         goto finish;
1ff636
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
181b3f
index a46ddf849..4c2e1b0b4 100644
1ff636
--- a/src/shared/selinux-util.c
1ff636
+++ b/src/shared/selinux-util.c
1ff636
@@ -200,11 +200,11 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
1ff636
         if (!mac_selinux_use())
1ff636
                 return -EOPNOTSUPP;
1ff636
 
1ff636
-        r = getcon(&mycon);
1ff636
+        r = getcon_raw(&mycon);
1ff636
         if (r < 0)
1ff636
                 return -errno;
1ff636
 
1ff636
-        r = getfilecon(exe, &fcon);
1ff636
+        r = getfilecon_raw(exe, &fcon);
1ff636
         if (r < 0)
1ff636
                 return -errno;
1ff636
 
1ff636
@@ -226,7 +226,7 @@ int mac_selinux_get_our_label(char **label) {
1ff636
         if (!mac_selinux_use())
1ff636
                 return -EOPNOTSUPP;
1ff636
 
1ff636
-        r = getcon(label);
1ff636
+        r = getcon_raw(label);
1ff636
         if (r < 0)
1ff636
                 return -errno;
1ff636
 #endif
1ff636
@@ -250,7 +250,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
1ff636
         if (!mac_selinux_use())
1ff636
                 return -EOPNOTSUPP;
1ff636
 
1ff636
-        r = getcon(&mycon);
1ff636
+        r = getcon_raw(&mycon);
1ff636
         if (r < 0)
1ff636
                 return -errno;
1ff636
 
1ff636
@@ -261,7 +261,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
1ff636
         if (!exec_label) {
1ff636
                 /* If there is no context set for next exec let's use context
1ff636
                    of target executable */
1ff636
-                r = getfilecon(exe, &fcon);
1ff636
+                r = getfilecon_raw(exe, &fcon);
1ff636
                 if (r < 0)
1ff636
                         return -errno;
1ff636
         }