Blame SOURCES/0099-ccpp-emulate-selinux-for-creation-of-compat-cores.patch

baab13
From 2f0a18b499b9b0e1afbdab8a8bb31d38f2acc6d8 Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Fri, 17 Apr 2015 16:06:33 +0200
baab13
Subject: [ABRT PATCH] ccpp: emulate selinux for creation of compat cores
baab13
baab13
This issue was discovered by Florian Weimer of Red Hat Product Security.
baab13
baab13
http://article.gmane.org/gmane.comp.security.selinux/21842
baab13
baab13
v2: use the _raw interface and do the preparation steps as root
baab13
v3: don't fail if SELinux is disabled
baab13
    https://github.com/abrt/abrt/commit/c4f06d4198658c82550e93bb2617b96022c06cf4#commitcomment-11021276
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 configure.ac               |  1 +
baab13
 src/hooks/Makefile.am      |  4 ++-
baab13
 src/hooks/abrt-hook-ccpp.c | 85 ++++++++++++++++++++++++++++++++++++++++++++--
baab13
 3 files changed, 86 insertions(+), 4 deletions(-)
baab13
baab13
diff --git a/configure.ac b/configure.ac
baab13
index 9ff616d..6c6d2e8 100644
baab13
--- a/configure.ac
baab13
+++ b/configure.ac
baab13
@@ -106,6 +106,7 @@ PKG_CHECK_MODULES([LIBREPORT_GTK], [libreport-gtk])
baab13
 PKG_CHECK_MODULES([POLKIT], [polkit-gobject-1])
baab13
 PKG_CHECK_MODULES([GIO], [gio-2.0])
baab13
 PKG_CHECK_MODULES([SATYR], [satyr])
baab13
+PKG_CHECK_MODULES([LIBSELINUX], [libselinux])
baab13
 
baab13
 PKG_PROG_PKG_CONFIG
baab13
 AC_ARG_WITH([systemdsystemunitdir],
baab13
diff --git a/src/hooks/Makefile.am b/src/hooks/Makefile.am
baab13
index e536089..9a527f4 100644
baab13
--- a/src/hooks/Makefile.am
baab13
+++ b/src/hooks/Makefile.am
baab13
@@ -33,10 +33,12 @@ abrt_hook_ccpp_CPPFLAGS = \
baab13
     -DDEFAULT_DUMP_DIR_MODE=$(DEFAULT_DUMP_DIR_MODE) \
baab13
     $(GLIB_CFLAGS) \
baab13
     $(LIBREPORT_CFLAGS) \
baab13
+    $(LIBSELINUX_CFLAGS) \
baab13
     -D_GNU_SOURCE
baab13
 abrt_hook_ccpp_LDADD = \
baab13
     ../lib/libabrt.la \
baab13
-    $(LIBREPORT_LIBS)
baab13
+    $(LIBREPORT_LIBS) \
baab13
+    $(LIBSELINUX_LIBS)
baab13
 
baab13
 # abrt-merge-pstoreoops
baab13
 abrt_merge_pstoreoops_SOURCES = \
baab13
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
baab13
index 81f9349..00ae621 100644
baab13
--- a/src/hooks/abrt-hook-ccpp.c
baab13
+++ b/src/hooks/abrt-hook-ccpp.c
baab13
@@ -20,6 +20,7 @@
baab13
 */
baab13
 #include <sys/utsname.h>
baab13
 #include "libabrt.h"
baab13
+#include <selinux/selinux.h>
baab13
 
baab13
 #define  DUMP_SUID_UNSAFE 1
baab13
 #define  DUMP_SUID_SAFE 2
baab13
@@ -286,6 +287,54 @@ static int dump_suid_policy()
baab13
     return suid_dump_policy;
baab13
 }
baab13
 
baab13
+/* Computes a security context of new file created by the given process with
baab13
+ * pid in the given directory represented by file descriptor.
baab13
+ *
baab13
+ * On errors returns negative number. Returns 0 if the function succeeds and
baab13
+ * computes the context and returns positive number and assigns NULL to newcon
baab13
+ * if the security context is not needed (SELinux disabled).
baab13
+ */
baab13
+static int compute_selinux_con_for_new_file(pid_t pid, int dir_fd, security_context_t *newcon)
baab13
+{
baab13
+    security_context_t srccon;
baab13
+    security_context_t dstcon;
baab13
+
baab13
+    const int r = is_selinux_enabled();
baab13
+    if (r == 0)
baab13
+    {
baab13
+        *newcon = NULL;
baab13
+        return 1;
baab13
+    }
baab13
+    else if (r == -1)
baab13
+    {
baab13
+        perror_msg("Couldn't get state of SELinux");
baab13
+        return -1;
baab13
+    }
baab13
+    else if (r != 1)
baab13
+        error_msg_and_die("Unexpected SELinux return value: %d", r);
baab13
+
baab13
+
baab13
+    if (getpidcon_raw(pid, &srccon) < 0)
baab13
+    {
baab13
+        perror_msg("getpidcon_raw(%d)", pid);
baab13
+        return -1;
baab13
+    }
baab13
+
baab13
+    if (fgetfilecon_raw(dir_fd, &dstcon) < 0)
baab13
+    {
baab13
+        perror_msg("getfilecon_raw(%s)", user_pwd);
baab13
+        return -1;
baab13
+    }
baab13
+
baab13
+    if (security_compute_create_raw(srccon, dstcon, string_to_security_class("file"), newcon) < 0)
baab13
+    {
baab13
+        perror_msg("security_compute_create_raw(%s, %s, 'file')", srccon, dstcon);
baab13
+        return -1;
baab13
+    }
baab13
+
baab13
+    return 0;
baab13
+}
baab13
+
baab13
 static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_values)
baab13
 {
baab13
     proc_cwd = open_cwd(pid);
baab13
@@ -294,6 +343,14 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
 
baab13
     errno = 0;
baab13
 
baab13
+    /* http://article.gmane.org/gmane.comp.security.selinux/21842 */
baab13
+    security_context_t newcon;
baab13
+    if (compute_selinux_con_for_new_file(pid, dirfd(proc_cwd), &newcon) < 0)
baab13
+    {
baab13
+        log_notice("Not going to create a user core due to SELinux errors");
baab13
+        return -1;
baab13
+    }
baab13
+
baab13
     xsetegid(get_fsgid());
baab13
     xseteuid(fsuid);
baab13
 
baab13
@@ -388,10 +445,25 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
      * (However, see the description of the prctl(2) PR_SET_DUMPABLE operation,
baab13
      * and the description of the /proc/sys/fs/suid_dumpable file in proc(5).)
baab13
      */
baab13
+
baab13
+    /* Set SELinux context like kernel when creating core dump file */
baab13
+    if (newcon != NULL && setfscreatecon_raw(newcon) < 0)
baab13
+    {
baab13
+        perror_msg("setfscreatecon_raw(%s)", newcon);
baab13
+        return -1;
baab13
+    }
baab13
+
baab13
     struct stat sb;
baab13
     errno = 0;
baab13
     /* Do not O_TRUNC: if later checks fail, we do not want to have file already modified here */
baab13
     int user_core_fd = openat(dirfd(proc_cwd), core_basename, O_WRONLY | O_CREAT | O_NOFOLLOW | g_user_core_flags, 0600); /* kernel makes 0600 too */
baab13
+
baab13
+    if (newcon != NULL && setfscreatecon_raw(NULL) < 0)
baab13
+    {
baab13
+        error_msg("setfscreatecon_raw(NULL)");
baab13
+        goto user_core_fail;
baab13
+    }
baab13
+
baab13
     xsetegid(0);
baab13
     xseteuid(0);
baab13
     if (user_core_fd < 0
baab13
@@ -404,16 +476,23 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
             perror_msg("Can't open '%s' at '%s'", core_basename, user_pwd);
baab13
         else
baab13
             perror_msg("'%s' at '%s' is not a regular file with link count 1 owned by UID(%d)", core_basename, user_pwd, fsuid);
baab13
-        return -1;
baab13
+        goto user_core_fail;
baab13
     }
baab13
     if (ftruncate(user_core_fd, 0) != 0) {
baab13
         /* perror first, otherwise unlink may trash errno */
baab13
         perror_msg("Can't truncate '%s' at '%s' to size 0", core_basename, user_pwd);
baab13
-        unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
baab13
-        return -1;
baab13
+        goto user_core_fail;
baab13
     }
baab13
 
baab13
     return user_core_fd;
baab13
+
baab13
+user_core_fail:
baab13
+    if (user_core_fd >= 0)
baab13
+    {
baab13
+        close(user_core_fd);
baab13
+        unlinkat(dirfd(proc_cwd), core_basename, /*unlink file*/0);
baab13
+    }
baab13
+    return -1;
baab13
 }
baab13
 
baab13
 static bool dump_fd_info(const char *dest_filename, char *source_filename, int source_base_ofs, uid_t uid, gid_t gid)
baab13
-- 
baab13
1.8.3.1
baab13