From 214c04af59ea09589743b88943a7ba0adac64a7a Mon Sep 17 00:00:00 2001 From: Michal Zidek Date: Wed, 24 Sep 2014 16:03:04 +0200 Subject: [PATCH 02/22] sss_semanage: Add mlsrange parameter to set_seuser MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mlsrange parameter will be needed in IPA provider and probably at some point in the tools as well. Reviewed-by: Lukáš Slebodník --- src/tools/sss_useradd.c | 2 +- src/tools/sss_usermod.c | 2 +- src/util/sss_semanage.c | 25 ++++++++++++++++--------- src/util/util.h | 3 ++- 4 files changed, 20 insertions(+), 12 deletions(-) diff --git a/src/tools/sss_useradd.c b/src/tools/sss_useradd.c index 59439401e225d752ea9a82fdb33900bf44699e18..8521b83011b42c9e2acca4136f154acb3919440c 100644 --- a/src/tools/sss_useradd.c +++ b/src/tools/sss_useradd.c @@ -205,7 +205,7 @@ int main(int argc, const char **argv) /* Set SELinux login context - must be done after transaction is done * b/c libselinux calls getpwnam */ - ret = set_seuser(tctx->octx->name, pc_selinux_user); + ret = set_seuser(tctx->octx->name, pc_selinux_user, NULL); if (ret != EOK) { ERROR("Cannot set SELinux login context\n"); ret = EXIT_FAILURE; diff --git a/src/tools/sss_usermod.c b/src/tools/sss_usermod.c index 9683c6e9e7c2bf389563515162a3772ee73987ed..55e94394766f5f46bb3c14c231186f2d79d6b6ab 100644 --- a/src/tools/sss_usermod.c +++ b/src/tools/sss_usermod.c @@ -300,7 +300,7 @@ int main(int argc, const char **argv) /* Set SELinux login context - must be done after transaction is done * b/c libselinux calls getpwnam */ - ret = set_seuser(tctx->octx->name, pc_selinux_user); + ret = set_seuser(tctx->octx->name, pc_selinux_user, NULL); if (ret != EOK) { ERROR("Cannot set SELinux login context\n"); ret = EXIT_FAILURE; diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c index dbef3b3437f9ac51021f30b510b9c15cd34e297a..3c566553f2085a696f79c5ee35ec6015824d56a6 100644 --- a/src/util/sss_semanage.c +++ b/src/util/sss_semanage.c @@ -22,7 +22,6 @@ #include "config.h" #include - #ifdef HAVE_SEMANAGE #include #endif @@ -118,7 +117,8 @@ fail: static int sss_semanage_user_add(semanage_handle_t *handle, semanage_seuser_key_t *key, const char *login_name, - const char *seuser_name) + const char *seuser_name, + const char *mls) { int ret; semanage_seuser_t *seuser = NULL; @@ -138,7 +138,8 @@ static int sss_semanage_user_add(semanage_handle_t *handle, goto done; } - ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE); + ret = semanage_seuser_set_mlsrange(handle, seuser, + mls ? mls : DEFAULT_SERANGE); if (ret != 0) { DEBUG(SSSDBG_CRIT_FAILURE, "Could not set serange for %s\n", login_name); @@ -171,7 +172,8 @@ done: static int sss_semanage_user_mod(semanage_handle_t *handle, semanage_seuser_key_t *key, const char *login_name, - const char *seuser_name) + const char *seuser_name, + const char *mls) { int ret; semanage_seuser_t *seuser = NULL; @@ -184,7 +186,8 @@ static int sss_semanage_user_mod(semanage_handle_t *handle, goto done; } - ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE); + ret = semanage_seuser_set_mlsrange(handle, seuser, + mls ? mls : DEFAULT_SERANGE); if (ret != 0) { DEBUG(SSSDBG_CRIT_FAILURE, "Could not set serange for %s\n", login_name); @@ -213,7 +216,8 @@ done: return ret; } -int set_seuser(const char *login_name, const char *seuser_name) +int set_seuser(const char *login_name, const char *seuser_name, + const char *mls) { semanage_handle_t *handle = NULL; semanage_seuser_key_t *key = NULL; @@ -247,14 +251,16 @@ int set_seuser(const char *login_name, const char *seuser_name) } if (seuser_exists) { - ret = sss_semanage_user_mod(handle, key, login_name, seuser_name); + ret = sss_semanage_user_mod(handle, key, login_name, seuser_name, + mls); if (ret != 0) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot modify SELinux user mapping\n"); ret = EIO; goto done; } } else { - ret = sss_semanage_user_add(handle, key, login_name, seuser_name); + ret = sss_semanage_user_add(handle, key, login_name, seuser_name, + mls); if (ret != 0) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot add SELinux user mapping\n"); ret = EIO; @@ -348,7 +354,8 @@ done: } #else /* HAVE_SEMANAGE */ -int set_seuser(const char *login_name, const char *seuser_name) +int set_seuser(const char *login_name, const char *seuser_name, + const char *mls) { return EOK; } diff --git a/src/util/util.h b/src/util/util.h index b43ce6f5092e9920609826bead483976fef2f9b1..0af4db3fec723ef372f7c1acde0e3f9f013f90e0 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -592,7 +592,8 @@ errno_t switch_creds(TALLOC_CTX *mem_ctx, errno_t restore_creds(struct sss_creds *saved_creds); /* from sss_semanage.c */ -int set_seuser(const char *login_name, const char *seuser_name); +int set_seuser(const char *login_name, const char *seuser_name, + const char *mlsrange); int del_seuser(const char *login_name); #endif /* __SSSD_UTIL_H__ */ -- 1.9.3