b8fa79
diff -up at-3.1.13/atd.c.selinux at-3.1.13/atd.c
b8fa79
--- at-3.1.13/atd.c.selinux	2012-11-01 15:11:21.368772308 +0100
b8fa79
+++ at-3.1.13/atd.c	2012-11-01 15:13:16.809162818 +0100
b8fa79
@@ -83,6 +83,14 @@
b8fa79
 #include "getloadavg.h"
b8fa79
 #endif
b8fa79
 
b8fa79
+#ifdef WITH_SELINUX
b8fa79
+#include <selinux/selinux.h>
b8fa79
+#include <selinux/get_context_list.h>
b8fa79
+int selinux_enabled=0;
b8fa79
+#include <selinux/flask.h>
b8fa79
+#include <selinux/av_permissions.h>
b8fa79
+#endif
b8fa79
+
b8fa79
 #ifndef LOG_ATD
b8fa79
 #define LOG_ATD        LOG_DAEMON
b8fa79
 #endif
b8fa79
@@ -202,6 +210,68 @@ myfork()
b8fa79
 #define ATD_MAIL_NAME    "mailx"
b8fa79
 #endif
b8fa79
 
b8fa79
+#ifdef WITH_SELINUX
b8fa79
+static int set_selinux_context(const char *name, const char *filename) {
b8fa79
+       security_context_t user_context=NULL;
b8fa79
+       security_context_t  file_context=NULL;
b8fa79
+       struct av_decision avd;
b8fa79
+       int retval=-1;
b8fa79
+       char *seuser=NULL;
b8fa79
+       char *level=NULL;
b8fa79
+
b8fa79
+       if (getseuserbyname(name, &seuser, &level) == 0) {
b8fa79
+               retval=get_default_context_with_level(seuser, level, NULL, &user_context);
b8fa79
+               free(seuser);
b8fa79
+               free(level);
b8fa79
+               if (retval) {
b8fa79
+                       if (security_getenforce()==1) {
b8fa79
+                               perr("execle: couldn't get security context for user %s\n", name);
b8fa79
+                       } else {
b8fa79
+                               syslog(LOG_ERR, "execle: couldn't get security context for user %s\n", name);
b8fa79
+                               return -1;
b8fa79
+                       }
b8fa79
+               }
b8fa79
+       }
b8fa79
+
b8fa79
+       /*
b8fa79
+       * Since crontab files are not directly executed,
b8fa79
+       * crond must ensure that the crontab file has
b8fa79
+       * a context that is appropriate for the context of
b8fa79
+       * the user cron job.  It performs an entrypoint
b8fa79
+       * permission check for this purpose.
b8fa79
+       */
b8fa79
+       if (fgetfilecon(STDIN_FILENO, &file_context) < 0)
b8fa79
+               perr("fgetfilecon FAILED %s", filename);
b8fa79
+
b8fa79
+       retval = security_compute_av(user_context,
b8fa79
+                                    file_context,
b8fa79
+                                    SECCLASS_FILE,
b8fa79
+                                    FILE__ENTRYPOINT,
b8fa79
+                                    &avd);
b8fa79
+       freecon(file_context);
b8fa79
+       if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
b8fa79
+               if (security_getenforce()==1) {
b8fa79
+                       perr("Not allowed to set exec context to %s for user  %s\n", user_context,name);
b8fa79
+               } else {
b8fa79
+                       syslog(LOG_ERR, "Not allowed to set exec context to %s for user  %s\n", user_context,name);
b8fa79
+                       retval = -1;
b8fa79
+                       goto err;
b8fa79
+               }
b8fa79
+       }
b8fa79
+       if (setexeccon(user_context) < 0) {
b8fa79
+               if (security_getenforce()==1) {
b8fa79
+                       perr("Could not set exec context to %s for user  %s\n", user_context,name);
b8fa79
+                       retval = -1;
b8fa79
+               } else {
b8fa79
+                       syslog(LOG_ERR, "Could not set exec context to %s for user  %s\n", user_context,name);
b8fa79
+               }
b8fa79
+       }
b8fa79
+  err:
b8fa79
+       freecon(user_context);
b8fa79
+       return 0;
b8fa79
+}
b8fa79
+#endif
b8fa79
+
b8fa79
 static void
b8fa79
 run_file(const char *filename, uid_t uid, gid_t gid)
b8fa79
 {
b8fa79
@@ -446,9 +516,23 @@ run_file(const char *filename, uid_t uid
b8fa79
 		perr("Cannot reset signal handler to default");
b8fa79
 
b8fa79
 	    chdir("/");
b8fa79
-
b8fa79
+#ifdef WITH_SELINUX
b8fa79
+            if (selinux_enabled > 0) {
b8fa79
+                if (set_selinux_context(pentry->pw_name, filename) < 0)
b8fa79
+                       perr("SELinux Failed to set context\n");
b8fa79
+            }
b8fa79
+#endif
b8fa79
 	    if (execle("/bin/sh", "sh", (char *) NULL, nenvp) != 0)
b8fa79
 		perr("Exec failed for /bin/sh");
b8fa79
+//add for fedora
b8fa79
+#ifdef WITH_SELINUX
b8fa79
+               if (selinux_enabled>0)
b8fa79
+                       if (setexeccon(NULL) < 0)
b8fa79
+                               if (security_getenforce()==1)
b8fa79
+                                       perr("Could not resset exec context for user %s\n", pentry->pw_name);
b8fa79
+#endif
b8fa79
+//end
b8fa79
+//add for fedora
b8fa79
 #ifdef  WITH_PAM
b8fa79
 	    if ( ( nenvp != &nul ) && (pam_envp != 0L)  && (*pam_envp != 0L))
b8fa79
 	    {
b8fa79
@@ -751,6 +835,10 @@ main(int argc, char *argv[])
b8fa79
     struct passwd *pwe;
b8fa79
     struct group *ge;
b8fa79
 
b8fa79
+#ifdef WITH_SELINUX
b8fa79
+    selinux_enabled=is_selinux_enabled();
b8fa79
+#endif
b8fa79
+
b8fa79
 /* We don't need root privileges all the time; running under uid and gid
b8fa79
  * daemon is fine.
b8fa79
  */
b8fa79
diff -up at-3.1.13/config.h.in.selinux at-3.1.13/config.h.in
b8fa79
--- at-3.1.13/config.h.in.selinux	2012-11-01 15:11:21.368772308 +0100
b8fa79
+++ at-3.1.13/config.h.in	2012-11-01 15:11:21.371772392 +0100
b8fa79
@@ -71,6 +71,9 @@
b8fa79
 /* Define if you are building with_pam */
b8fa79
 #undef WITH_PAM
b8fa79
 
b8fa79
+/* Define if you are building with_selinux  */
b8fa79
+#undef WITH_SELINUX
b8fa79
+
b8fa79
 /* Define to 1 if you have the `pstat_getdynamic' function. */
b8fa79
 #undef HAVE_PSTAT_GETDYNAMIC
b8fa79
 
b8fa79
diff -up at-3.1.13/configure.ac.selinux at-3.1.13/configure.ac
b8fa79
--- at-3.1.13/configure.ac.selinux	2012-11-01 15:11:21.369772335 +0100
b8fa79
+++ at-3.1.13/configure.ac	2012-11-01 15:11:21.372772420 +0100
b8fa79
@@ -266,5 +266,13 @@ AC_ARG_WITH(daemon_groupname,
b8fa79
 )
b8fa79
 AC_SUBST(DAEMON_GROUPNAME)
b8fa79
 
b8fa79
+AC_ARG_WITH(selinux,
b8fa79
+[ --with-selinux       Define to run with selinux],
b8fa79
+AC_DEFINE(WITH_SELINUX),
b8fa79
+)
b8fa79
+AC_CHECK_LIB(selinux, is_selinux_enabled, SELINUXLIB=-lselinux)
b8fa79
+AC_SUBST(SELINUXLIB)
b8fa79
+AC_SUBST(WITH_SELINUX)
b8fa79
+
b8fa79
 AC_CONFIG_FILES(Makefile atrun atd.8 atrun.8 at.1 at.allow.5 batch)
b8fa79
 AC_OUTPUT
b8fa79
diff -up at-3.1.13/Makefile.in.selinux at-3.1.13/Makefile.in
b8fa79
--- at-3.1.13/Makefile.in.selinux	2012-11-01 15:11:21.361772115 +0100
b8fa79
+++ at-3.1.13/Makefile.in	2012-11-01 15:11:21.372772420 +0100
b8fa79
@@ -39,6 +39,8 @@ LIBS		= @LIBS@
b8fa79
 LIBOBJS		= @LIBOBJS@
b8fa79
 INSTALL		= @INSTALL@
b8fa79
 PAMLIB          = @PAMLIB@
b8fa79
+SELINUXLIB      = @SELINUXLIB@
b8fa79
+
b8fa79
 
b8fa79
 CLONES		= atq atrm
b8fa79
 ATOBJECTS	= at.o panic.o perm.o posixtm.o y.tab.o lex.yy.o