daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
923a60
From 2d30914ae86e9f40c02d80e0ef5c01e54efbbbc9 Mon Sep 17 00:00:00 2001
923a60
From: Michal Sekletar <msekleta@redhat.com>
923a60
Date: Tue, 1 Sep 2015 16:02:58 +0200
923a60
Subject: [PATCH] selinux: always use *_raw API from libselinux
923a60
923a60
When mcstransd* is running non-raw functions will return translated SELinux
923a60
context. Problem is that libselinux will cache this information and in the
923a60
future it will return same context even though mcstransd maybe not running at
923a60
that time. If you then check with such context against SELinux policy then
923a60
selinux_check_access may fail depending on whether mcstransd is running or not.
923a60
923a60
To workaround this problem/bug in libselinux, we should always get raw context
923a60
instead. Most users will not notice because they don't use MCS/MLS policy
923a60
anyway. Others will most likely not notice as well because result of access
923a60
check is logged only in debug mode.
923a60
923a60
* Service which translates labels to human readable form
923a60
923a60
Resolves: #1256888
923a60
---
923a60
 src/core/selinux-access.c |  4 ++--
923a60
 src/shared/selinux-util.c | 10 +++++-----
923a60
 2 files changed, 7 insertions(+), 7 deletions(-)
923a60
923a60
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
923a60
index f11247c092..297372d126 100644
923a60
--- a/src/core/selinux-access.c
923a60
+++ b/src/core/selinux-access.c
923a60
@@ -219,13 +219,13 @@ int mac_selinux_generic_access_check(
923a60
         if (path && !system) {
923a60
                 /* Get the file context of the unit file */
923a60
 
923a60
-                r = getfilecon(path, &fcon);
923a60
+                r = getfilecon_raw(path, &fcon);
923a60
                 if (r < 0) {
923a60
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
923a60
                         goto finish;
923a60
                 }
923a60
         } else {
923a60
-                r = getcon(&fcon);
923a60
+                r = getcon_raw(&fcon);
923a60
                 if (r < 0) {
923a60
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
923a60
                         goto finish;
923a60
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
923a60
index a46ddf8498..4c2e1b0b47 100644
923a60
--- a/src/shared/selinux-util.c
923a60
+++ b/src/shared/selinux-util.c
923a60
@@ -200,11 +200,11 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
923a60
         if (!mac_selinux_use())
923a60
                 return -EOPNOTSUPP;
923a60
 
923a60
-        r = getcon(&mycon);
923a60
+        r = getcon_raw(&mycon);
923a60
         if (r < 0)
923a60
                 return -errno;
923a60
 
923a60
-        r = getfilecon(exe, &fcon);
923a60
+        r = getfilecon_raw(exe, &fcon);
923a60
         if (r < 0)
923a60
                 return -errno;
923a60
 
923a60
@@ -226,7 +226,7 @@ int mac_selinux_get_our_label(char **label) {
923a60
         if (!mac_selinux_use())
923a60
                 return -EOPNOTSUPP;
923a60
 
923a60
-        r = getcon(label);
923a60
+        r = getcon_raw(label);
923a60
         if (r < 0)
923a60
                 return -errno;
923a60
 #endif
923a60
@@ -250,7 +250,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
923a60
         if (!mac_selinux_use())
923a60
                 return -EOPNOTSUPP;
923a60
 
923a60
-        r = getcon(&mycon);
923a60
+        r = getcon_raw(&mycon);
923a60
         if (r < 0)
923a60
                 return -errno;
923a60
 
923a60
@@ -261,7 +261,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
923a60
         if (!exec_label) {
923a60
                 /* If there is no context set for next exec let's use context
923a60
                    of target executable */
923a60
-                r = getfilecon(exe, &fcon);
923a60
+                r = getfilecon_raw(exe, &fcon);
923a60
                 if (r < 0)
923a60
                         return -errno;
923a60
         }