|
 |
891120 |
From bcf8c3dd5ea4c085d1f6f8e7cbee0c516a4e1d78 Mon Sep 17 00:00:00 2001
|
|
 |
891120 |
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
|
|
 |
891120 |
Date: Fri, 27 Sep 2019 08:47:41 -0600
|
|
 |
891120 |
Subject: [PATCH] Add some debugging around context setting and tty labeling
|
|
 |
891120 |
Also be more extact with error return values
|
|
 |
891120 |
|
|
 |
891120 |
---
|
|
 |
891120 |
src/selinux.c | 96 ++++++++++++++++++++++++++++-----------------------
|
|
 |
891120 |
1 file changed, 52 insertions(+), 44 deletions(-)
|
|
 |
891120 |
|
|
 |
891120 |
diff --git a/src/selinux.c b/src/selinux.c
|
|
 |
891120 |
index e56be9e17..801999e61 100644
|
|
 |
891120 |
--- a/src/selinux.c
|
|
 |
891120 |
+++ b/src/selinux.c
|
|
 |
891120 |
@@ -106,42 +106,53 @@ audit_role_change(const security_context_t old_context,
|
|
 |
891120 |
* fd - referencing the opened ttyn
|
|
 |
891120 |
* ttyn - name of tty to restore
|
|
 |
891120 |
*
|
|
 |
891120 |
- * Returns zero on success, non-zero otherwise
|
|
 |
891120 |
+ * Returns 0 on success and -1 on failure.
|
|
 |
891120 |
*/
|
|
 |
891120 |
int
|
|
 |
891120 |
selinux_restore_tty(void)
|
|
 |
891120 |
{
|
|
 |
891120 |
- int retval = 0;
|
|
 |
891120 |
+ int ret = -1;
|
|
 |
891120 |
security_context_t chk_tty_context = NULL;
|
|
 |
891120 |
debug_decl(selinux_restore_tty, SUDO_DEBUG_SELINUX)
|
|
 |
891120 |
|
|
 |
891120 |
- if (se_state.ttyfd == -1 || se_state.new_tty_context == NULL)
|
|
 |
891120 |
- goto skip_relabel;
|
|
 |
891120 |
+ if (se_state.ttyfd == -1 || se_state.new_tty_context == NULL) {
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: no tty, skip relabel",
|
|
 |
891120 |
+ __func__);
|
|
 |
891120 |
+ debug_return_int(0);
|
|
 |
891120 |
+ }
|
|
 |
891120 |
+
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: %s -> %s",
|
|
 |
891120 |
+ __func__, se_state.new_tty_context, se_state.tty_context);
|
|
 |
891120 |
|
|
 |
891120 |
/* Verify that the tty still has the context set by sudo. */
|
|
 |
891120 |
- if ((retval = fgetfilecon(se_state.ttyfd, &chk_tty_context)) < 0) {
|
|
 |
891120 |
+ if (fgetfilecon(se_state.ttyfd, &chk_tty_context) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to fgetfilecon %s"), se_state.ttyn);
|
|
 |
891120 |
goto skip_relabel;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
- if ((retval = strcmp(chk_tty_context, se_state.new_tty_context))) {
|
|
 |
891120 |
+ if (strcmp(chk_tty_context, se_state.new_tty_context) == 0) {
|
|
 |
891120 |
sudo_warnx(U_("%s changed labels"), se_state.ttyn);
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: tty label changed, skipping",
|
|
 |
891120 |
+ __func__);
|
|
 |
891120 |
goto skip_relabel;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
- if ((retval = fsetfilecon(se_state.ttyfd, se_state.tty_context)) < 0)
|
|
 |
891120 |
+ if (fsetfilecon(se_state.ttyfd, se_state.tty_context) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to restore context for %s"), se_state.ttyn);
|
|
 |
891120 |
+ goto skip_relabel;
|
|
 |
891120 |
+ }
|
|
 |
891120 |
+
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: successfully set tty label to %s",
|
|
 |
891120 |
+ __func__, se_state.tty_context);
|
|
 |
891120 |
+ ret = 0;
|
|
 |
891120 |
|
|
 |
891120 |
skip_relabel:
|
|
 |
891120 |
if (se_state.ttyfd != -1) {
|
|
 |
891120 |
close(se_state.ttyfd);
|
|
 |
891120 |
se_state.ttyfd = -1;
|
|
 |
891120 |
}
|
|
 |
891120 |
- if (chk_tty_context != NULL) {
|
|
 |
891120 |
- freecon(chk_tty_context);
|
|
 |
891120 |
- chk_tty_context = NULL;
|
|
 |
891120 |
- }
|
|
 |
891120 |
- debug_return_int(retval);
|
|
 |
891120 |
+ freecon(chk_tty_context);
|
|
 |
891120 |
+ debug_return_int(ret);
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
/*
|
|
 |
891120 |
@@ -164,8 +175,11 @@ relabel_tty(const char *ttyn, int ptyfd)
|
|
 |
891120 |
se_state.ttyfd = ptyfd;
|
|
 |
891120 |
|
|
 |
891120 |
/* It is perfectly legal to have no tty. */
|
|
 |
891120 |
- if (ptyfd == -1 && ttyn == NULL)
|
|
 |
891120 |
+ if (ptyfd == -1 && ttyn == NULL) {
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: no tty, skip relabel",
|
|
 |
891120 |
+ __func__);
|
|
 |
891120 |
debug_return_int(0);
|
|
 |
891120 |
+ }
|
|
 |
891120 |
|
|
 |
891120 |
/* If sudo is not allocating a pty for the command, open current tty. */
|
|
 |
891120 |
if (ptyfd == -1) {
|
|
 |
891120 |
@@ -183,26 +197,28 @@ relabel_tty(const char *ttyn, int ptyfd)
|
|
 |
891120 |
fcntl(se_state.ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
- if (fgetfilecon(se_state.ttyfd, &tty_con) < 0) {
|
|
 |
891120 |
+ if (fgetfilecon(se_state.ttyfd, &tty_con) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to get current tty context, not relabeling tty"));
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
- if (tty_con) {
|
|
 |
891120 |
+ if (tty_con != NULL) {
|
|
 |
891120 |
security_class_t tclass = string_to_security_class("chr_file");
|
|
 |
891120 |
if (tclass == 0) {
|
|
 |
891120 |
sudo_warn(U_("unknown security class \"chr_file\", not relabeling tty"));
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
if (security_compute_relabel(se_state.new_context, tty_con,
|
|
 |
891120 |
- tclass, &new_tty_con) < 0) {
|
|
 |
891120 |
+ tclass, &new_tty_con) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to get new tty context, not relabeling tty"));
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
if (new_tty_con != NULL) {
|
|
 |
891120 |
- if (fsetfilecon(se_state.ttyfd, new_tty_con) < 0) {
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: tty context %s -> %s",
|
|
 |
891120 |
+ __func__, tty_con, new_tty_con);
|
|
 |
891120 |
+ if (fsetfilecon(se_state.ttyfd, new_tty_con) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to set new tty context"));
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
@@ -276,12 +292,12 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
|
|
 |
891120 |
debug_decl(get_exec_context, SUDO_DEBUG_SELINUX)
|
|
 |
891120 |
|
|
 |
891120 |
/* We must have a role, the type is optional (we can use the default). */
|
|
 |
891120 |
- if (!role) {
|
|
 |
891120 |
+ if (role == NULL) {
|
|
 |
891120 |
sudo_warnx(U_("you must specify a role for type %s"), type);
|
|
 |
891120 |
errno = EINVAL;
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
- if (!type) {
|
|
 |
891120 |
+ if (type == NULL) {
|
|
 |
891120 |
if (get_default_type(role, &typebuf)) {
|
|
 |
891120 |
sudo_warnx(U_("unable to get default type for role %s"), role);
|
|
 |
891120 |
errno = EINVAL;
|
|
 |
891120 |
@@ -291,10 +307,13 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
/*
|
|
 |
891120 |
- * Expand old_context into a context_t so that we extract and modify
|
|
 |
891120 |
+ * Expand old_context into a context_t so that we can extract and modify
|
|
 |
891120 |
* its components easily.
|
|
 |
891120 |
*/
|
|
 |
891120 |
- context = context_new(old_context);
|
|
 |
891120 |
+ if ((context = context_new(old_context)) == NULL) {
|
|
 |
891120 |
+ sudo_warn(U_("failed to get new context"));
|
|
 |
891120 |
+ goto bad;
|
|
 |
891120 |
+ }
|
|
 |
891120 |
|
|
 |
891120 |
/*
|
|
 |
891120 |
* Replace the role and type in "context" with the role and
|
|
 |
891120 |
@@ -316,24 +335,20 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
|
|
 |
891120 |
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
- if (security_check_context(new_context) < 0) {
|
|
 |
891120 |
+ if (security_check_context(new_context) == -1) {
|
|
 |
891120 |
sudo_warnx(U_("%s is not a valid context"), new_context);
|
|
 |
891120 |
errno = EINVAL;
|
|
 |
891120 |
goto bad;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
-#ifdef DEBUG
|
|
 |
891120 |
- sudo_warnx("Your new context is %s", new_context);
|
|
 |
891120 |
-#endif
|
|
 |
891120 |
-
|
|
 |
891120 |
context_free(context);
|
|
 |
891120 |
- debug_return_ptr(new_context);
|
|
 |
891120 |
+ debug_return_str(new_context);
|
|
 |
891120 |
|
|
 |
891120 |
bad:
|
|
 |
891120 |
free(typebuf);
|
|
 |
891120 |
context_free(context);
|
|
 |
891120 |
freecon(new_context);
|
|
 |
891120 |
- debug_return_ptr(NULL);
|
|
 |
891120 |
+ debug_return_str(NULL);
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
/*
|
|
 |
891120 |
@@ -352,40 +367,33 @@ selinux_setup(const char *role, const char *type, const char *ttyn,
|
|
 |
891120 |
|
|
 |
891120 |
/* Store the caller's SID in old_context. */
|
|
 |
891120 |
if (getprevcon(&se_state.old_context)) {
|
|
 |
891120 |
- sudo_warn(U_("failed to get old_context"));
|
|
 |
891120 |
+ sudo_warn(U_("failed to get old context"));
|
|
 |
891120 |
goto done;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
se_state.enforcing = security_getenforce();
|
|
 |
891120 |
- if (se_state.enforcing < 0) {
|
|
 |
891120 |
+ if (se_state.enforcing == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to determine enforcing mode."));
|
|
 |
891120 |
goto done;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
-#ifdef DEBUG
|
|
 |
891120 |
- sudo_warnx("your old context was %s", se_state.old_context);
|
|
 |
891120 |
-#endif
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: old context %s", __func__,
|
|
 |
891120 |
+ se_state.old_context);
|
|
 |
891120 |
se_state.new_context = get_exec_context(se_state.old_context, role, type);
|
|
 |
891120 |
- if (!se_state.new_context) {
|
|
 |
891120 |
+ if (se_state.new_context == NULL) {
|
|
 |
891120 |
#ifdef HAVE_LINUX_AUDIT
|
|
 |
891120 |
- audit_role_change(se_state.old_context, "?",
|
|
 |
891120 |
- se_state.ttyn, 0);
|
|
 |
891120 |
+ audit_role_change(se_state.old_context, "?", se_state.ttyn, 0);
|
|
 |
891120 |
#endif
|
|
 |
891120 |
goto done;
|
|
 |
891120 |
}
|
|
 |
891120 |
+ sudo_debug_printf(SUDO_DEBUG_INFO, "%s: new context %s", __func__,
|
|
 |
891120 |
+ se_state.new_context);
|
|
 |
891120 |
|
|
 |
891120 |
- if (relabel_tty(ttyn, ptyfd) < 0) {
|
|
 |
891120 |
+ if (relabel_tty(ttyn, ptyfd) == -1) {
|
|
 |
891120 |
sudo_warn(U_("unable to set tty context to %s"), se_state.new_context);
|
|
 |
891120 |
goto done;
|
|
 |
891120 |
}
|
|
 |
891120 |
|
|
 |
891120 |
-#ifdef DEBUG
|
|
 |
891120 |
- if (se_state.ttyfd != -1) {
|
|
 |
891120 |
- sudo_warnx("your old tty context is %s", se_state.tty_context);
|
|
 |
891120 |
- sudo_warnx("your new tty context is %s", se_state.new_tty_context);
|
|
 |
891120 |
- }
|
|
 |
891120 |
-#endif
|
|
 |
891120 |
-
|
|
 |
891120 |
#ifdef HAVE_LINUX_AUDIT
|
|
 |
891120 |
audit_role_change(se_state.old_context, se_state.new_context,
|
|
 |
891120 |
se_state.ttyn, 1);
|