|
 |
1745f7 |
From 1f866530f5b3c49012c61b299f3c4e1dceff2a71 Mon Sep 17 00:00:00 2001
|
|
|
1745f7 |
From: Tomas Mraz <tmraz@fedoraproject.org>
|
|
|
1745f7 |
Date: Thu, 18 Oct 2018 14:25:58 +0200
|
|
|
1745f7 |
Subject: [PATCH] Use the role from the crond context for system job contexts.
|
|
|
1745f7 |
|
|
|
1745f7 |
New SELinux policy added multiple roles for the system_u user on crond_t.
|
|
|
1745f7 |
The default context returned from get_default_context_with_level() is now
|
|
|
1745f7 |
unconfined_t instead of system_cronjob_t which is incorrect for system cron
|
|
|
1745f7 |
jobs.
|
|
|
1745f7 |
We use the role to limit the default context to system_cronjob_t.
|
|
|
1745f7 |
---
|
|
|
1745f7 |
src/security.c | 6 ++++--
|
|
|
1745f7 |
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
1745f7 |
|
|
|
1745f7 |
diff --git a/src/security.c b/src/security.c
|
|
|
1745f7 |
index d1bdc7f..5213cf3 100644
|
|
|
1745f7 |
--- a/src/security.c
|
|
|
1745f7 |
+++ b/src/security.c
|
|
|
1745f7 |
@@ -505,6 +505,7 @@ get_security_context(const char *name, int crontab_fd,
|
|
|
1745f7 |
retval = get_default_context_with_level(seuser, level, NULL, &scontext);
|
|
|
1745f7 |
}
|
|
|
1745f7 |
else {
|
|
|
1745f7 |
+ const char *current_user, *current_role;
|
|
|
1745f7 |
if (getcon(¤t_context_str) < 0) {
|
|
|
1745f7 |
log_it(name, getpid(), "getcon FAILED", "", 0);
|
|
|
1745f7 |
return (security_getenforce() > 0);
|
|
|
1745f7 |
@@ -517,8 +518,9 @@ get_security_context(const char *name, int crontab_fd,
|
|
|
1745f7 |
return (security_getenforce() > 0);
|
|
|
1745f7 |
}
|
|
|
1745f7 |
|
|
|
1745f7 |
- const char *current_user = context_user_get(current_context);
|
|
|
1745f7 |
- retval = get_default_context_with_level(current_user, level, NULL, &scontext);
|
|
|
1745f7 |
+ current_user = context_user_get(current_context);
|
|
|
1745f7 |
+ current_role = context_role_get(current_context);
|
|
|
1745f7 |
+ retval = get_default_context_with_rolelevel(current_user, current_role, level, NULL, &scontext);
|
|
|
1745f7 |
|
|
|
1745f7 |
freecon(current_context_str);
|
|
|
1745f7 |
context_free(current_context);
|
|
|
1745f7 |
--
|
|
|
1745f7 |
2.14.5
|
|
|
1745f7 |
|