|
 |
b725e7 |
From 1a04637d4c07762c44889963eb25a405d24397cf Mon Sep 17 00:00:00 2001
|
|
|
b725e7 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
b725e7 |
Date: Thu, 12 Mar 2015 16:31:13 +0100
|
|
|
b725e7 |
Subject: [PATCH 193/193] selinux: Handle setup with empty default and no
|
|
|
b725e7 |
configured rules
|
|
|
b725e7 |
MIME-Version: 1.0
|
|
|
b725e7 |
Content-Type: text/plain; charset=UTF-8
|
|
|
b725e7 |
Content-Transfer-Encoding: 8bit
|
|
|
b725e7 |
|
|
|
b725e7 |
SSSD also needs to handle the setup where no rules match the machine and
|
|
|
b725e7 |
the default has no MLS component.
|
|
|
b725e7 |
|
|
|
b725e7 |
Related to:
|
|
|
b725e7 |
https://fedorahosted.org/sssd/ticket/2587
|
|
|
b725e7 |
|
|
|
b725e7 |
Reviewed-by: Michal Židek <mzidek@redhat.com>
|
|
|
b725e7 |
(cherry picked from commit 3e6dac8e14f8a3da6d359ee013453dbd8a38dd99)
|
|
|
b725e7 |
(cherry picked from commit 4b6ee69fb1f713aae125b0fc2d345846e7a0d642)
|
|
|
b725e7 |
---
|
|
|
b725e7 |
src/providers/ipa/ipa_selinux.c | 4 ++--
|
|
|
b725e7 |
src/providers/ipa/selinux_child.c | 10 ++++++++--
|
|
|
b725e7 |
2 files changed, 10 insertions(+), 4 deletions(-)
|
|
|
b725e7 |
|
|
|
b725e7 |
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
|
|
|
b725e7 |
index 0716536cdb3b34d386ed1a31e6a239a09173b25b..899dd07105a98faac9430211404499911434f6d6 100644
|
|
|
b725e7 |
--- a/src/providers/ipa/ipa_selinux.c
|
|
|
b725e7 |
+++ b/src/providers/ipa/ipa_selinux.c
|
|
|
b725e7 |
@@ -808,7 +808,7 @@ selinux_child_setup(TALLOC_CTX *mem_ctx,
|
|
|
b725e7 |
{
|
|
|
b725e7 |
errno_t ret;
|
|
|
b725e7 |
char *seuser;
|
|
|
b725e7 |
- char *mls_range;
|
|
|
b725e7 |
+ const char *mls_range;
|
|
|
b725e7 |
char *ptr;
|
|
|
b725e7 |
char *username;
|
|
|
b725e7 |
char *username_final;
|
|
|
b725e7 |
@@ -834,7 +834,7 @@ selinux_child_setup(TALLOC_CTX *mem_ctx,
|
|
|
b725e7 |
}
|
|
|
b725e7 |
if (*ptr == '\0') {
|
|
|
b725e7 |
/* No mls_range specified */
|
|
|
b725e7 |
- mls_range = NULL;
|
|
|
b725e7 |
+ mls_range = "";
|
|
|
b725e7 |
} else {
|
|
|
b725e7 |
*ptr = '\0'; /* split */
|
|
|
b725e7 |
mls_range = ptr + 1;
|
|
|
b725e7 |
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
|
|
|
b725e7 |
index 2f79dea109752de09af1105495e1ca8db1e80680..abcb93b1a76783fd048ddebc976830ac42e1f757 100644
|
|
|
b725e7 |
--- a/src/providers/ipa/selinux_child.c
|
|
|
b725e7 |
+++ b/src/providers/ipa/selinux_child.c
|
|
|
b725e7 |
@@ -49,7 +49,9 @@ static errno_t unpack_buffer(uint8_t *buf,
|
|
|
b725e7 |
SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
|
|
|
b725e7 |
DEBUG(SSSDBG_TRACE_INTERNAL, "seuser length: %d\n", len);
|
|
|
b725e7 |
if (len == 0) {
|
|
|
b725e7 |
- return EINVAL;
|
|
|
b725e7 |
+ ibuf->seuser = "";
|
|
|
b725e7 |
+ DEBUG(SSSDBG_TRACE_INTERNAL,
|
|
|
b725e7 |
+ "Empty SELinux user, will delete the mapping\n");
|
|
|
b725e7 |
} else {
|
|
|
b725e7 |
if ((p + len ) > size) return EINVAL;
|
|
|
b725e7 |
ibuf->seuser = talloc_strndup(ibuf, (char *)(buf + p), len);
|
|
|
b725e7 |
@@ -62,7 +64,10 @@ static errno_t unpack_buffer(uint8_t *buf,
|
|
|
b725e7 |
SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
|
|
|
b725e7 |
DEBUG(SSSDBG_TRACE_INTERNAL, "mls_range length: %d\n", len);
|
|
|
b725e7 |
if (len == 0) {
|
|
|
b725e7 |
- return EINVAL;
|
|
|
b725e7 |
+ if (strcmp(ibuf->seuser, "") != 0) {
|
|
|
b725e7 |
+ DEBUG(SSSDBG_CRIT_FAILURE, "No MLS mapping!\n");
|
|
|
b725e7 |
+ return EINVAL;
|
|
|
b725e7 |
+ }
|
|
|
b725e7 |
} else {
|
|
|
b725e7 |
if ((p + len ) > size) return EINVAL;
|
|
|
b725e7 |
ibuf->mls_range = talloc_strndup(ibuf, (char *)(buf + p), len);
|
|
|
b725e7 |
@@ -75,6 +80,7 @@ static errno_t unpack_buffer(uint8_t *buf,
|
|
|
b725e7 |
SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
|
|
|
b725e7 |
DEBUG(SSSDBG_TRACE_INTERNAL, "username length: %d\n", len);
|
|
|
b725e7 |
if (len == 0) {
|
|
|
b725e7 |
+ DEBUG(SSSDBG_CRIT_FAILURE, "No username set!\n");
|
|
|
b725e7 |
return EINVAL;
|
|
|
b725e7 |
} else {
|
|
|
b725e7 |
if ((p + len ) > size) return EINVAL;
|
|
|
b725e7 |
--
|
|
|
b725e7 |
2.1.0
|
|
|
b725e7 |
|