|
 |
ecf709 |
From 3a07827a3722fd2166b94af1f5790273fbac01eb Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
ecf709 |
Date: Mon, 3 Apr 2017 12:56:01 +0200
|
|
|
ecf709 |
Subject: [PATCH 97/99] responders: do not leak selinux context on clients
|
|
|
ecf709 |
destruction
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
The SELinux context created in get_client_cred is not talloc bound and
|
|
|
ecf709 |
we were leaking it if available with each client's destruction.
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves:
|
|
|
ecf709 |
https://pagure.io/SSSD/sssd/issue/3360
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit 05c2c3047912fca1c1a35ab1c8d3157b05383495)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/responder/common/responder_common.c | 20 +++++++++++++++++++-
|
|
|
ecf709 |
1 file changed, 19 insertions(+), 1 deletion(-)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c
|
|
|
ecf709 |
index 154d7dc7718c437d10e152fcba98161e2034fb14..67e1deefdfde19c95a68029b11099579d851513f 100644
|
|
|
ecf709 |
--- a/src/responder/common/responder_common.c
|
|
|
ecf709 |
+++ b/src/responder/common/responder_common.c
|
|
|
ecf709 |
@@ -97,7 +97,7 @@ static errno_t get_client_cred(struct cli_ctx *cctx)
|
|
|
ecf709 |
SEC_CTX secctx;
|
|
|
ecf709 |
int ret;
|
|
|
ecf709 |
|
|
|
ecf709 |
- cctx->creds = talloc(cctx, struct cli_creds);
|
|
|
ecf709 |
+ cctx->creds = talloc_zero(cctx, struct cli_creds);
|
|
|
ecf709 |
if (!cctx->creds) return ENOMEM;
|
|
|
ecf709 |
|
|
|
ecf709 |
#ifdef HAVE_UCRED
|
|
|
ecf709 |
@@ -464,6 +464,22 @@ static void client_fd_handler(struct tevent_context *ev,
|
|
|
ecf709 |
|
|
|
ecf709 |
static errno_t setup_client_idle_timer(struct cli_ctx *cctx);
|
|
|
ecf709 |
|
|
|
ecf709 |
+static int cli_ctx_destructor(struct cli_ctx *cctx)
|
|
|
ecf709 |
+{
|
|
|
ecf709 |
+ if (cctx->creds == NULL) {
|
|
|
ecf709 |
+ return 0;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ if (cctx->creds->selinux_ctx == NULL) {
|
|
|
ecf709 |
+ return 0;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ SELINUX_context_free(cctx->creds->selinux_ctx);
|
|
|
ecf709 |
+ cctx->creds->selinux_ctx = NULL;
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ return 0;
|
|
|
ecf709 |
+}
|
|
|
ecf709 |
+
|
|
|
ecf709 |
struct accept_fd_ctx {
|
|
|
ecf709 |
struct resp_ctx *rctx;
|
|
|
ecf709 |
bool is_private;
|
|
|
ecf709 |
@@ -520,6 +536,8 @@ static void accept_fd_handler(struct tevent_context *ev,
|
|
|
ecf709 |
return;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
+ talloc_set_destructor(cctx, cli_ctx_destructor);
|
|
|
ecf709 |
+
|
|
|
ecf709 |
len = sizeof(cctx->addr);
|
|
|
ecf709 |
cctx->cfd = accept(fd, (struct sockaddr *)&cctx->addr, &len;;
|
|
|
ecf709 |
if (cctx->cfd == -1) {
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.3
|
|
|
ecf709 |
|