|
 |
803fb7 |
From 2d30914ae86e9f40c02d80e0ef5c01e54efbbbc9 Mon Sep 17 00:00:00 2001
|
|
|
803fb7 |
From: Michal Sekletar <msekleta@redhat.com>
|
|
|
803fb7 |
Date: Tue, 1 Sep 2015 16:02:58 +0200
|
|
|
803fb7 |
Subject: [PATCH] selinux: always use *_raw API from libselinux
|
|
|
803fb7 |
|
|
|
803fb7 |
When mcstransd* is running non-raw functions will return translated SELinux
|
|
|
803fb7 |
context. Problem is that libselinux will cache this information and in the
|
|
|
803fb7 |
future it will return same context even though mcstransd maybe not running at
|
|
|
803fb7 |
that time. If you then check with such context against SELinux policy then
|
|
|
803fb7 |
selinux_check_access may fail depending on whether mcstransd is running or not.
|
|
|
803fb7 |
|
|
|
803fb7 |
To workaround this problem/bug in libselinux, we should always get raw context
|
|
|
803fb7 |
instead. Most users will not notice because they don't use MCS/MLS policy
|
|
|
803fb7 |
anyway. Others will most likely not notice as well because result of access
|
|
|
803fb7 |
check is logged only in debug mode.
|
|
|
803fb7 |
|
|
|
803fb7 |
* Service which translates labels to human readable form
|
|
|
803fb7 |
|
|
|
803fb7 |
Resolves: #1256888
|
|
|
803fb7 |
---
|
|
|
803fb7 |
src/core/selinux-access.c | 4 ++--
|
|
|
803fb7 |
src/shared/selinux-util.c | 10 +++++-----
|
|
|
803fb7 |
2 files changed, 7 insertions(+), 7 deletions(-)
|
|
|
803fb7 |
|
|
|
803fb7 |
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
|
|
|
803fb7 |
index f11247c09..297372d12 100644
|
|
|
803fb7 |
--- a/src/core/selinux-access.c
|
|
|
803fb7 |
+++ b/src/core/selinux-access.c
|
|
|
803fb7 |
@@ -219,13 +219,13 @@ int mac_selinux_generic_access_check(
|
|
|
803fb7 |
if (path && !system) {
|
|
|
803fb7 |
/* Get the file context of the unit file */
|
|
|
803fb7 |
|
|
|
803fb7 |
- r = getfilecon(path, &fcon);
|
|
|
803fb7 |
+ r = getfilecon_raw(path, &fcon);
|
|
|
803fb7 |
if (r < 0) {
|
|
|
803fb7 |
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
|
|
|
803fb7 |
goto finish;
|
|
|
803fb7 |
}
|
|
|
803fb7 |
} else {
|
|
|
803fb7 |
- r = getcon(&fcon);
|
|
|
803fb7 |
+ r = getcon_raw(&fcon);
|
|
|
803fb7 |
if (r < 0) {
|
|
|
803fb7 |
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
|
|
|
803fb7 |
goto finish;
|
|
|
803fb7 |
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
|
|
|
803fb7 |
index a46ddf849..4c2e1b0b4 100644
|
|
|
803fb7 |
--- a/src/shared/selinux-util.c
|
|
|
803fb7 |
+++ b/src/shared/selinux-util.c
|
|
|
803fb7 |
@@ -200,11 +200,11 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
|
|
|
803fb7 |
if (!mac_selinux_use())
|
|
|
803fb7 |
return -EOPNOTSUPP;
|
|
|
803fb7 |
|
|
|
803fb7 |
- r = getcon(&mycon);
|
|
|
803fb7 |
+ r = getcon_raw(&mycon);
|
|
|
803fb7 |
if (r < 0)
|
|
|
803fb7 |
return -errno;
|
|
|
803fb7 |
|
|
|
803fb7 |
- r = getfilecon(exe, &fcon);
|
|
|
803fb7 |
+ r = getfilecon_raw(exe, &fcon);
|
|
|
803fb7 |
if (r < 0)
|
|
|
803fb7 |
return -errno;
|
|
|
803fb7 |
|
|
|
803fb7 |
@@ -226,7 +226,7 @@ int mac_selinux_get_our_label(char **label) {
|
|
|
803fb7 |
if (!mac_selinux_use())
|
|
|
803fb7 |
return -EOPNOTSUPP;
|
|
|
803fb7 |
|
|
|
803fb7 |
- r = getcon(label);
|
|
|
803fb7 |
+ r = getcon_raw(label);
|
|
|
803fb7 |
if (r < 0)
|
|
|
803fb7 |
return -errno;
|
|
|
803fb7 |
#endif
|
|
|
803fb7 |
@@ -250,7 +250,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
|
|
|
803fb7 |
if (!mac_selinux_use())
|
|
|
803fb7 |
return -EOPNOTSUPP;
|
|
|
803fb7 |
|
|
|
803fb7 |
- r = getcon(&mycon);
|
|
|
803fb7 |
+ r = getcon_raw(&mycon);
|
|
|
803fb7 |
if (r < 0)
|
|
|
803fb7 |
return -errno;
|
|
|
803fb7 |
|
|
|
803fb7 |
@@ -261,7 +261,7 @@ int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *
|
|
|
803fb7 |
if (!exec_label) {
|
|
|
803fb7 |
/* If there is no context set for next exec let's use context
|
|
|
803fb7 |
of target executable */
|
|
|
803fb7 |
- r = getfilecon(exe, &fcon);
|
|
|
803fb7 |
+ r = getfilecon_raw(exe, &fcon);
|
|
|
803fb7 |
if (r < 0)
|
|
|
803fb7 |
return -errno;
|
|
|
803fb7 |
}
|