From 0006bd76856787614f961001929fea95d0669fe5 Mon Sep 17 00:00:00 2001 From: Justin Stephenson Date: Thu, 9 Mar 2017 17:21:37 -0500 Subject: [PATCH 203/205] SELINUX: Use getseuserbyname to get IPA seuser MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The libselinux function getseuserbyname is more reliable method to retrieve SELinux usernames then functions from libsemanage `semanage_user_query` and is recommended by libsemanage developers. Replace get_seuser function with getseuserbyname. Resolves: https://pagure.io/SSSD/sssd/issue/3308 Reviewed-by: Michal Židek Reviewed-by: Jakub Hrozek Reviewed-by: Petr Lautrbach (cherry picked from commit cfe87ca0c4fded9cbf907697d08fa0e6c8f8ebce) --- Makefile.am | 1 + src/providers/ipa/selinux_child.c | 12 +++---- src/util/sss_semanage.c | 73 --------------------------------------- src/util/util.h | 2 -- 4 files changed, 7 insertions(+), 81 deletions(-) diff --git a/Makefile.am b/Makefile.am index cdd517d50679b876814303fb7d6c63d49bcd8d38..1eb398830e4817d4da0878a6577b45df101e920d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -4094,6 +4094,7 @@ selinux_child_LDADD = \ $(POPT_LIBS) \ $(DHASH_LIBS) \ $(SEMANAGE_LIBS) \ + $(SELINUX_LIBS) \ $(NULL) endif diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c index f8dd3954a7244df2dcbb910aabf8888f41306c09..073475094ee491bd5453898c6ba65214fa14fe59 100644 --- a/src/providers/ipa/selinux_child.c +++ b/src/providers/ipa/selinux_child.c @@ -27,6 +27,7 @@ #include #include #include +#include #include "util/util.h" #include "util/child_common.h" @@ -172,11 +173,10 @@ static bool seuser_needs_update(struct input_buffer *ibuf) char *db_mls_range = NULL; errno_t ret; - ret = get_seuser(ibuf, ibuf->username, &db_seuser, &db_mls_range); + ret = getseuserbyname(ibuf->username, &db_seuser, &db_mls_range); DEBUG(SSSDBG_TRACE_INTERNAL, - "get_seuser: ret: %d msg: [%s] seuser: %s mls: %s\n", - ret, sss_strerror(ret), - db_seuser ? db_seuser : "unknown", + "getseuserbyname: ret: %d seuser: %s mls: %s\n", + ret, db_seuser ? db_seuser : "unknown", db_mls_range ? db_mls_range : "unknown"); if (ret == EOK && db_seuser && db_mls_range && strcmp(db_seuser, ibuf->seuser) == 0 && @@ -188,8 +188,8 @@ static bool seuser_needs_update(struct input_buffer *ibuf) needs_update = false; } - talloc_free(db_seuser); - talloc_free(db_mls_range); + free(db_seuser); + free(db_mls_range); return needs_update; } diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c index 0da97aad4d8eba733b131c2749932e03ca4242c4..37278cc986a1ea49dc2218a635d52b9d54ca089d 100644 --- a/src/util/sss_semanage.c +++ b/src/util/sss_semanage.c @@ -382,73 +382,6 @@ done: sss_semanage_close(handle); return ret; } - -int get_seuser(TALLOC_CTX *mem_ctx, const char *login_name, - char **_seuser, char **_mls_range) -{ - errno_t ret; - const char *seuser; - const char *mls_range; - semanage_handle_t *sm_handle = NULL; - semanage_seuser_t *sm_user = NULL; - semanage_seuser_key_t *sm_key = NULL; - - ret = sss_semanage_init(&sm_handle); - if (ret == ERR_SELINUX_NOT_MANAGED) { - goto done; - } else if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux handle\n"); - goto done; - } - - ret = semanage_seuser_key_create(sm_handle, login_name, &sm_key); - if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create key for %s\n", login_name); - ret = EIO; - goto done; - } - - ret = semanage_seuser_query(sm_handle, sm_key, &sm_user); - if (ret < 0) { - DEBUG(SSSDBG_CRIT_FAILURE, "Cannot query for %s\n", login_name); - ret = EIO; - goto done; - } - - seuser = semanage_seuser_get_sename(sm_user); - if (seuser != NULL) { - *_seuser = talloc_strdup(mem_ctx, seuser); - if (*_seuser == NULL) { - ret = ENOMEM; - goto done; - } - DEBUG(SSSDBG_OP_FAILURE, - "SELinux user for %s: %s\n", login_name, *_seuser); - } else { - DEBUG(SSSDBG_CRIT_FAILURE, "Cannot get sename for %s\n", login_name); - } - - mls_range = semanage_seuser_get_mlsrange(sm_user); - if (mls_range != NULL) { - *_mls_range = talloc_strdup(mem_ctx, mls_range); - if (*_mls_range == NULL) { - ret = ENOMEM; - goto done; - } - DEBUG(SSSDBG_OP_FAILURE, - "SELinux range for %s: %s\n", login_name, *_mls_range); - } else { - DEBUG(SSSDBG_CRIT_FAILURE, "Cannot get mlsrange for %s\n", login_name); - } - - ret = EOK; -done: - semanage_seuser_key_free(sm_key); - semanage_seuser_free(sm_user); - sss_semanage_close(sm_handle); - return ret; -} - #else /* HAVE_SEMANAGE */ int set_seuser(const char *login_name, const char *seuser_name, const char *mls) @@ -460,10 +393,4 @@ int del_seuser(const char *login_name) { return EOK; } - -int get_seuser(TALLOC_CTX *mem_ctx, const char *login_name, - char **_seuser, char **_mls_range) -{ - return EOK; -} #endif /* HAVE_SEMANAGE */ diff --git a/src/util/util.h b/src/util/util.h index 72d4116e1206e9cc69715edc45bf5b9b91e37e6b..1719d8eec1b6b05877b9be3382589e442bff85be 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -658,8 +658,6 @@ errno_t restore_creds(struct sss_creds *saved_creds); int set_seuser(const char *login_name, const char *seuser_name, const char *mlsrange); int del_seuser(const char *login_name); -int get_seuser(TALLOC_CTX *mem_ctx, const char *login_name, - char **_seuser, char **_mls_range); /* convert time from generalized form to unix time */ errno_t sss_utc_to_time_t(const char *str, const char *format, time_t *unix_time); -- 2.14.3