From d0a2b8832732d297321fddcad56872511ff212f2 Mon Sep 17 00:00:00 2001

From: Michael Scherer <misc@zarb.org>

Date: Thu, 6 Feb 2014 10:05:16 +0100

Subject: [PATCH] exec: Add SELinuxContext configuration item

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

This permit to let system administrators decide of the domain of a service.

This can be used with templated units to have each service in a différent

domain ( for example, a per customer database, using MLS or anything ),

or can be used to force a non selinux enabled system (jvm, erlang, etc)

to start in a different domain for each service.

Conflicts:

        src/core/dbus-execute.c

        src/core/execute.c

        src/core/execute.h

        src/shared/exit-status.c

        src/shared/exit-status.h

(cherry picked from commit 7b52a628f8b43ba521c302a7f32bccf9d0dc8bfd)

Related: #1113790

---

 man/systemd.exec.xml                  | 11 +++++++++++

 src/core/dbus-execute.c               |  1 +

 src/core/execute.c                    | 27 +++++++++++++++++++++++++++

 src/core/execute.h                    |  2 ++

 src/core/load-fragment-gperf.gperf.m4 |  3 ++-

 src/shared/exit-status.c              |  3 +++

 src/shared/exit-status.h              |  1 +

 7 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml

index 612b4d2..a68cfa7 100644

--- a/man/systemd.exec.xml

+++ b/man/systemd.exec.xml

@@ -919,6 +919,17 @@

                         </varlistentry>

                         <varlistentry>

+                                <term><varname>SELinuxContext=</varname></term>

+

+                                <listitem><para>Set the SELinux context of the

+                                executed process. If set, this will override the

+                                automated domain transition. However, the policy

+                                still need to autorize the transition. See

+                                <citerefentry><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>

+                                for details.</para></listitem>

+                        </varlistentry>

+

+                        <varlistentry>

                                 <term><varname>IgnoreSIGPIPE=</varname></term>

                                 <listitem><para>Takes a boolean

diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c

index 2402e8c..97d75fa 100644

--- a/src/core/dbus-execute.c

+++ b/src/core/dbus-execute.c

@@ -429,6 +429,7 @@ const BusProperty bus_exec_context_properties[] = {

         { "PrivateNetwork",           bus_property_append_bool,              "b", offsetof(ExecContext, private_network)              },

         { "SameProcessGroup",         bus_property_append_bool,              "b", offsetof(ExecContext, same_pgrp)                    },

         { "UtmpIdentifier",           bus_property_append_string,            "s", offsetof(ExecContext, utmp_id),                true },

+        { "SELinuxContext",           bus_property_append_string,            "s", offsetof(ExecContext, selinux_context),        true },

         { "IgnoreSIGPIPE",            bus_property_append_bool,              "b", offsetof(ExecContext, ignore_sigpipe)               },

         { "NoNewPrivileges",          bus_property_append_bool,              "b", offsetof(ExecContext, no_new_privileges)            },

         { "SystemCallFilter",         bus_execute_append_syscall_filter,    "au", 0                                                   },

diff --git a/src/core/execute.c b/src/core/execute.c

index 981b9e4..cf9d24e 100644

--- a/src/core/execute.c

+++ b/src/core/execute.c

@@ -46,6 +46,10 @@

 #include <security/pam_appl.h>

 #endif

+#ifdef HAVE_SELINUX

+#include <selinux/selinux.h>

+#endif

+

 #include "execute.h"

 #include "strv.h"

 #include "macro.h"

@@ -1467,6 +1471,20 @@ int exec_spawn(ExecCommand *command,

                                         goto fail_child;

                                 }

                         }

+#ifdef HAVE_SELINUX

+                        if (context->selinux_context) {

+                                err = security_check_context(context->selinux_context);

+                                if (err < 0) {

+                                        r = EXIT_SELINUX_CONTEXT;

+                                        goto fail_child;

+                                }

+                                err = setexeccon(context->selinux_context);

+                                if (err < 0) {

+                                        r = EXIT_SELINUX_CONTEXT;

+                                        goto fail_child;

+                                }

+                        }

+#endif

                 }

                 our_env = new0(char*, 7);

@@ -1696,6 +1714,9 @@ void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {

         free(c->utmp_id);

         c->utmp_id = NULL;

+        free(c->selinux_context);

+        c->selinux_context = NULL;

+

         free(c->syscall_filter);

         c->syscall_filter = NULL;

@@ -2067,6 +2088,12 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {

                 fprintf(f,

                         "%sUtmpIdentifier: %s\n",

                         prefix, c->utmp_id);

+

+        if (c->selinux_context)

+                fprintf(f,

+                        "%sSELinuxContext: %s\n",

+                        prefix, c->selinux_context);

+

 }

 void exec_status_start(ExecStatus *s, pid_t pid) {

diff --git a/src/core/execute.h b/src/core/execute.h

index c1e9717..92ac8dd 100644

--- a/src/core/execute.h

+++ b/src/core/execute.h

@@ -124,6 +124,8 @@ struct ExecContext {

         char *utmp_id;

+        char *selinux_context;

+

         char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;

         unsigned long mount_flags;

diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4

index 0991cb9..935f04e 100644

--- a/src/core/load-fragment-gperf.gperf.m4

+++ b/src/core/load-fragment-gperf.gperf.m4

@@ -75,7 +75,8 @@ $1.MountFlags,                   config_parse_exec_mount_flags,      0,

 $1.TCPWrapName,                  config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.tcpwrap_name)

 $1.PAMName,                      config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.pam_name)

 $1.IgnoreSIGPIPE,                config_parse_bool,                  0,                             offsetof($1, exec_context.ignore_sigpipe)

-$1.UtmpIdentifier,               config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.utmp_id)'

+$1.UtmpIdentifier,               config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.utmp_id)

+$1.SELinuxContext,               config_parse_unit_string_printf,    0,                             offsetof($1, exec_context.selinux_context)'

 )m4_dnl

 m4_define(`KILL_CONTEXT_CONFIG_ITEMS',

 `$1.SendSIGKILL,                 config_parse_bool,                  0,                             offsetof($1, kill_context.send_sigkill)

diff --git a/src/shared/exit-status.c b/src/shared/exit-status.c

index f15fdba..676291b 100644

--- a/src/shared/exit-status.c

+++ b/src/shared/exit-status.c

@@ -131,6 +131,9 @@ const char* exit_status_to_string(ExitStatus status, ExitStatusLevel level) {

                 case EXIT_SECCOMP:

                         return "SECCOMP";

+                case EXIT_SELINUX_CONTEXT:

+                        return "SELINUX_CONTEXT";

+

                 case EXIT_CHOWN:

                         return "CHOWN";

diff --git a/src/shared/exit-status.h b/src/shared/exit-status.h

index 52dd3d0..798f1e1 100644

--- a/src/shared/exit-status.h

+++ b/src/shared/exit-status.h

@@ -68,6 +68,7 @@ typedef enum ExitStatus {

         EXIT_NAMESPACE,

         EXIT_NO_NEW_PRIVILEGES,

         EXIT_SECCOMP,

+        EXIT_SELINUX_CONTEXT,

         EXIT_CHOWN

 } ExitStatus;