Blame SOURCES/0204-SELINUX-Check-if-SELinux-is-managed-in-selinux_child.patch

5e7617
From 8db75e9ebbdaec1dde836380ca38d8cfec61cf3d Mon Sep 17 00:00:00 2001
5e7617
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
5e7617
Date: Thu, 1 Feb 2018 11:34:21 +0100
5e7617
Subject: [PATCH 204/205] SELINUX: Check if SELinux is managed in selinux_child
5e7617
MIME-Version: 1.0
5e7617
Content-Type: text/plain; charset=UTF-8
5e7617
Content-Transfer-Encoding: 8bit
5e7617
5e7617
If SELinux policy is not managed at all, don't call any SELinux user
5e7617
handling functions and instead return that no update is needed.
5e7617
5e7617
Pair-Programmed-With: Jakub Hrozek <jhrozek@redhat.com>
5e7617
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
5e7617
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
5e7617
5e7617
Resolves:
5e7617
https://pagure.io/SSSD/sssd/issue/3618
5e7617
(cherry picked from commit 450b472a68abf442479755c7916c757907b35ea5)
5e7617
---
5e7617
 src/providers/ipa/selinux_child.c |  3 +-
5e7617
 src/util/sss_semanage.c           | 82 +++++++++++++++++++++++++++++++--------
5e7617
 src/util/util.h                   |  3 ++
5e7617
 3 files changed, 70 insertions(+), 18 deletions(-)
5e7617
5e7617
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
5e7617
index 073475094ee491bd5453898c6ba65214fa14fe59..bc9460e122ce991087a744fd5335e6c468c6a64b 100644
5e7617
--- a/src/providers/ipa/selinux_child.c
5e7617
+++ b/src/providers/ipa/selinux_child.c
5e7617
@@ -27,7 +27,6 @@
5e7617
 #include <unistd.h>
5e7617
 #include <sys/stat.h>
5e7617
 #include <popt.h>
5e7617
-#include <selinux/selinux.h>
5e7617
 
5e7617
 #include "util/util.h"
5e7617
 #include "util/child_common.h"
5e7617
@@ -173,7 +172,7 @@ static bool seuser_needs_update(struct input_buffer *ibuf)
5e7617
     char *db_mls_range = NULL;
5e7617
     errno_t ret;
5e7617
 
5e7617
-    ret = getseuserbyname(ibuf->username, &db_seuser, &db_mls_range);
5e7617
+    ret = sss_get_seuser(ibuf->username, &db_seuser, &db_mls_range);
5e7617
     DEBUG(SSSDBG_TRACE_INTERNAL,
5e7617
           "getseuserbyname: ret: %d seuser: %s mls: %s\n",
5e7617
           ret, db_seuser ? db_seuser : "unknown",
5e7617
diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c
5e7617
index 37278cc986a1ea49dc2218a635d52b9d54ca089d..25b6bcdad2ad7e7ac710497f13d6a6e22360b0dd 100644
5e7617
--- a/src/util/sss_semanage.c
5e7617
+++ b/src/util/sss_semanage.c
5e7617
@@ -22,8 +22,9 @@
5e7617
 #include "config.h"
5e7617
 
5e7617
 #include <stdio.h>
5e7617
-#ifdef HAVE_SEMANAGE
5e7617
+#if defined(HAVE_SEMANAGE) && defined(HAVE_SELINUX)
5e7617
 #include <semanage/semanage.h>
5e7617
+#include <selinux/selinux.h>
5e7617
 #endif
5e7617
 
5e7617
 #include "util/util.h"
5e7617
@@ -32,7 +33,7 @@
5e7617
 #define DEFAULT_SERANGE "s0"
5e7617
 #endif
5e7617
 
5e7617
-#ifdef HAVE_SEMANAGE
5e7617
+#if defined(HAVE_SEMANAGE) && defined(HAVE_SELINUX)
5e7617
 /* turn libselinux messages into SSSD DEBUG() calls */
5e7617
 static void sss_semanage_error_callback(void *varg,
5e7617
                                         semanage_handle_t *handle,
5e7617
@@ -73,33 +74,47 @@ static void sss_semanage_close(semanage_handle_t *handle)
5e7617
     semanage_handle_destroy(handle);
5e7617
 }
5e7617
 
5e7617
-static int sss_semanage_init(semanage_handle_t **_handle)
5e7617
+static int sss_is_selinux_managed(semanage_handle_t *handle)
5e7617
 {
5e7617
     int ret;
5e7617
-    semanage_handle_t *handle = NULL;
5e7617
 
5e7617
-    handle = semanage_handle_create();
5e7617
-    if (!handle) {
5e7617
-        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux management handle\n");
5e7617
-        ret = EIO;
5e7617
-        goto done;
5e7617
+    if (handle == NULL) {
5e7617
+        return EINVAL;
5e7617
     }
5e7617
 
5e7617
-    semanage_msg_set_callback(handle,
5e7617
-                              sss_semanage_error_callback,
5e7617
-                              NULL);
5e7617
-
5e7617
     ret = semanage_is_managed(handle);
5e7617
     if (ret == 0) {
5e7617
         DEBUG(SSSDBG_TRACE_FUNC, "SELinux policy not managed via libsemanage\n");
5e7617
-        ret = ERR_SELINUX_NOT_MANAGED;
5e7617
-        goto done;
5e7617
+        return ERR_SELINUX_NOT_MANAGED;
5e7617
     } else if (ret == -1) {
5e7617
         DEBUG(SSSDBG_CRIT_FAILURE, "Call to semanage_is_managed failed\n");
5e7617
+        return EIO;
5e7617
+    }
5e7617
+
5e7617
+    return EOK;
5e7617
+}
5e7617
+
5e7617
+static int sss_semanage_init(semanage_handle_t **_handle)
5e7617
+{
5e7617
+    int ret;
5e7617
+    semanage_handle_t *handle = NULL;
5e7617
+
5e7617
+    handle = semanage_handle_create();
5e7617
+    if (!handle) {
5e7617
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux management handle\n");
5e7617
         ret = EIO;
5e7617
         goto done;
5e7617
     }
5e7617
 
5e7617
+    semanage_msg_set_callback(handle,
5e7617
+                              sss_semanage_error_callback,
5e7617
+                              NULL);
5e7617
+
5e7617
+    ret = sss_is_selinux_managed(handle);
5e7617
+    if (ret != EOK) {
5e7617
+        goto done;
5e7617
+    }
5e7617
+
5e7617
     ret = semanage_access_check(handle);
5e7617
     if (ret < SEMANAGE_CAN_READ) {
5e7617
         DEBUG(SSSDBG_CRIT_FAILURE, "Cannot read SELinux policy store\n");
5e7617
@@ -229,6 +244,34 @@ done:
5e7617
     return ret;
5e7617
 }
5e7617
 
5e7617
+int sss_get_seuser(const char *linuxuser,
5e7617
+                   char **selinuxuser,
5e7617
+                   char **level)
5e7617
+{
5e7617
+    int ret;
5e7617
+    semanage_handle_t *handle;
5e7617
+
5e7617
+    handle = semanage_handle_create();
5e7617
+    if (handle == NULL) {
5e7617
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux management handle\n");
5e7617
+        return EIO;
5e7617
+    }
5e7617
+
5e7617
+    semanage_msg_set_callback(handle,
5e7617
+                              sss_semanage_error_callback,
5e7617
+                              NULL);
5e7617
+
5e7617
+    /* We only needed the handle for this call. Close the handle right
5e7617
+     * after it */
5e7617
+    ret = sss_is_selinux_managed(handle);
5e7617
+    sss_semanage_close(handle);
5e7617
+    if (ret != EOK) {
5e7617
+        return ret;
5e7617
+    }
5e7617
+
5e7617
+    return getseuserbyname(linuxuser, selinuxuser, level);
5e7617
+}
5e7617
+
5e7617
 int set_seuser(const char *login_name, const char *seuser_name,
5e7617
                const char *mls)
5e7617
 {
5e7617
@@ -382,7 +425,7 @@ done:
5e7617
     sss_semanage_close(handle);
5e7617
     return ret;
5e7617
 }
5e7617
-#else /* HAVE_SEMANAGE */
5e7617
+#else /* HAVE_SEMANAGE && HAVE_SELINUX */
5e7617
 int set_seuser(const char *login_name, const char *seuser_name,
5e7617
                const char *mls)
5e7617
 {
5e7617
@@ -393,4 +436,11 @@ int del_seuser(const char *login_name)
5e7617
 {
5e7617
     return EOK;
5e7617
 }
5e7617
+
5e7617
+int sss_get_seuser(const char *linuxuser,
5e7617
+                   char **selinuxuser,
5e7617
+                   char **level)
5e7617
+{
5e7617
+    return EOK;
5e7617
+}
5e7617
 #endif  /* HAVE_SEMANAGE */
5e7617
diff --git a/src/util/util.h b/src/util/util.h
5e7617
index 1719d8eec1b6b05877b9be3382589e442bff85be..74ce2dcecfe17d1cea96cfb5c4b7edb8fd46f09f 100644
5e7617
--- a/src/util/util.h
5e7617
+++ b/src/util/util.h
5e7617
@@ -658,6 +658,9 @@ errno_t restore_creds(struct sss_creds *saved_creds);
5e7617
 int set_seuser(const char *login_name, const char *seuser_name,
5e7617
                const char *mlsrange);
5e7617
 int del_seuser(const char *login_name);
5e7617
+int sss_get_seuser(const char *linuxuser,
5e7617
+                   char **selinuxuser,
5e7617
+                   char **level);
5e7617
 
5e7617
 /* convert time from generalized form to unix time */
5e7617
 errno_t sss_utc_to_time_t(const char *str, const char *format, time_t *unix_time);
5e7617
-- 
5e7617
2.14.3
5e7617