From e3f34eb2e0edc9cefe92e58e2ad4c98bcccf2090 Mon Sep 17 00:00:00 2001

From: Lukas Nykryn <lnykryn@redhat.com>

Date: Thu, 27 Aug 2015 10:33:15 +0200

Subject: [PATCH] selinux: fix check for transient units

SELinux does not have a path to check for a snapshot service creation.

This ends up giving us a bogus check.

On snapshot creation we should check if the remote process type, has the

ability to start a service with the type that systemd is running with.

Based on patch from Vaclav Pavlin and Dan Walsh

http://lists.freedesktop.org/archives/systemd-devel/2013-November/014021.html

RHEL only

Resolves: #1255129

---

 src/core/dbus-manager.c   |  4 ++--

 src/core/selinux-access.c | 11 ++++++-----

 src/core/selinux-access.h |  9 ++++++---

 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c

index 2bc37ba..1ec350e 100644

--- a/src/core/dbus-manager.c

+++ b/src/core/dbus-manager.c

@@ -734,7 +734,7 @@ static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, voi

         if (mode < 0)

                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode);

-        r = mac_selinux_access_check(message, "start", error);

+        r = mac_selinux_runtime_unit_access_check(message, "start", error);

         if (r < 0)

                 return r;

@@ -1092,7 +1092,7 @@ static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *us

         assert(message);

         assert(m);

-        r = mac_selinux_access_check(message, "start", error);

+        r = mac_selinux_runtime_unit_access_check(message, "start", error);

         if (r < 0)

                 return r;

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c

index ce4f394..91460b8 100644

--- a/src/core/selinux-access.c

+++ b/src/core/selinux-access.c

@@ -175,6 +175,7 @@ void mac_selinux_access_free(void) {

 */

 int mac_selinux_generic_access_check(

                 sd_bus_message *message,

+                bool system,

                 const char *path,

                 const char *permission,

                 sd_bus_error *error) {

@@ -213,7 +214,9 @@ int mac_selinux_generic_access_check(

         if (r < 0)

                 goto finish;

-        if (path) {

+        tclass = "service";

+

+        if (path && !system) {

                 /* Get the file context of the unit file */

                 r = getfilecon(path, &fcon);

@@ -221,16 +224,14 @@ int mac_selinux_generic_access_check(

                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);

                         goto finish;

                 }

-

-                tclass = "service";

         } else {

                 r = getcon(&fcon);

                 if (r < 0) {

                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");

                         goto finish;

                 }

-

-                tclass = "system";

+                if (system)

+                        tclass = "system";

         }

         sd_bus_creds_get_cmdline(creds, &cmdline);

diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h

index dd1e8bb..7dc271b 100644

--- a/src/core/selinux-access.h

+++ b/src/core/selinux-access.h

@@ -28,21 +28,24 @@

 void mac_selinux_access_free(void);

-int mac_selinux_generic_access_check(sd_bus_message *message, const char *path, const char *permission, sd_bus_error *error);

+int mac_selinux_generic_access_check(sd_bus_message *message, bool system, const char *path, const char *permission, sd_bus_error *error);

 int mac_selinux_unit_access_check_strv(char **units, sd_bus_message *message, Manager *m, const char *permission, sd_bus_error *error);

 #ifdef HAVE_SELINUX

 #define mac_selinux_access_check(message, permission, error) \

-        mac_selinux_generic_access_check((message), NULL, (permission), (error))

+        mac_selinux_generic_access_check((message), true, NULL, (permission), (error))

 #define mac_selinux_unit_access_check(unit, message, permission, error) \

         ({                                                              \

                 Unit *_unit = (unit);                                   \

-                mac_selinux_generic_access_check((message), _unit->source_path ?: _unit->fragment_path, (permission), (error)); \

+                mac_selinux_generic_access_check((message), false, _unit->source_path ?: _unit->fragment_path, (permission), (error)); \

         })

+#define mac_selinux_runtime_unit_access_check(message, permission, error) \

+        mac_selinux_generic_access_check((message), false, NULL, (permission), (error))

+

 #else

 #define mac_selinux_access_check(message, permission, error) 0