Blame SOURCES/sudo-1.9.7-tty-relabel1.patch

891120
From bcf8c3dd5ea4c085d1f6f8e7cbee0c516a4e1d78 Mon Sep 17 00:00:00 2001
891120
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
891120
Date: Fri, 27 Sep 2019 08:47:41 -0600
891120
Subject: [PATCH] Add some debugging around context setting and tty labeling
891120
 Also be more extact with error return values
891120
891120
---
891120
 src/selinux.c | 96 ++++++++++++++++++++++++++++-----------------------
891120
 1 file changed, 52 insertions(+), 44 deletions(-)
891120
891120
diff --git a/src/selinux.c b/src/selinux.c
891120
index e56be9e17..801999e61 100644
891120
--- a/src/selinux.c
891120
+++ b/src/selinux.c
891120
@@ -106,42 +106,53 @@ audit_role_change(const security_context_t old_context,
891120
  * fd		   - referencing the opened ttyn
891120
  * ttyn		   - name of tty to restore
891120
  *
891120
- * Returns zero on success, non-zero otherwise
891120
+ * Returns 0 on success and -1 on failure.
891120
  */
891120
 int
891120
 selinux_restore_tty(void)
891120
 {
891120
-    int retval = 0;
891120
+    int ret = -1;
891120
     security_context_t chk_tty_context = NULL;
891120
     debug_decl(selinux_restore_tty, SUDO_DEBUG_SELINUX)
891120
 
891120
-    if (se_state.ttyfd == -1 || se_state.new_tty_context == NULL)
891120
-	goto skip_relabel;
891120
+    if (se_state.ttyfd == -1 || se_state.new_tty_context == NULL) {
891120
+	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: no tty, skip relabel",
891120
+	    __func__);
891120
+	debug_return_int(0);
891120
+    }
891120
+
891120
+    sudo_debug_printf(SUDO_DEBUG_INFO, "%s: %s -> %s",
891120
+	__func__, se_state.new_tty_context, se_state.tty_context);
891120
 
891120
     /* Verify that the tty still has the context set by sudo. */
891120
-    if ((retval = fgetfilecon(se_state.ttyfd, &chk_tty_context)) < 0) {
891120
+    if (fgetfilecon(se_state.ttyfd, &chk_tty_context) == -1) {
891120
 	sudo_warn(U_("unable to fgetfilecon %s"), se_state.ttyn);
891120
 	goto skip_relabel;
891120
     }
891120
 
891120
-    if ((retval = strcmp(chk_tty_context, se_state.new_tty_context))) {
891120
+    if (strcmp(chk_tty_context, se_state.new_tty_context) == 0) {
891120
 	sudo_warnx(U_("%s changed labels"), se_state.ttyn);
891120
+	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: tty label changed, skipping",
891120
+	    __func__);
891120
 	goto skip_relabel;
891120
     }
891120
 
891120
-    if ((retval = fsetfilecon(se_state.ttyfd, se_state.tty_context)) < 0)
891120
+    if (fsetfilecon(se_state.ttyfd, se_state.tty_context) == -1) {
891120
 	sudo_warn(U_("unable to restore context for %s"), se_state.ttyn);
891120
+	goto skip_relabel;
891120
+    }
891120
+
891120
+    sudo_debug_printf(SUDO_DEBUG_INFO, "%s: successfully set tty label to %s",
891120
+	__func__, se_state.tty_context);
891120
+    ret = 0;
891120
 
891120
 skip_relabel:
891120
     if (se_state.ttyfd != -1) {
891120
 	close(se_state.ttyfd);
891120
 	se_state.ttyfd = -1;
891120
     }
891120
-    if (chk_tty_context != NULL) {
891120
-	freecon(chk_tty_context);
891120
-	chk_tty_context = NULL;
891120
-    }
891120
-    debug_return_int(retval);
891120
+    freecon(chk_tty_context);
891120
+    debug_return_int(ret);
891120
 }
891120
 
891120
 /*
891120
@@ -164,8 +175,11 @@ relabel_tty(const char *ttyn, int ptyfd)
891120
     se_state.ttyfd = ptyfd;
891120
 
891120
     /* It is perfectly legal to have no tty. */
891120
-    if (ptyfd == -1 && ttyn == NULL)
891120
+    if (ptyfd == -1 && ttyn == NULL) {
891120
+	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: no tty, skip relabel",
891120
+	    __func__);
891120
 	debug_return_int(0);
891120
+    }
891120
 
891120
     /* If sudo is not allocating a pty for the command, open current tty. */
891120
     if (ptyfd == -1) {
891120
@@ -183,26 +197,28 @@ relabel_tty(const char *ttyn, int ptyfd)
891120
 	    fcntl(se_state.ttyfd, F_GETFL, 0) & ~O_NONBLOCK);
891120
     }
891120
 
891120
-    if (fgetfilecon(se_state.ttyfd, &tty_con) < 0) {
891120
+    if (fgetfilecon(se_state.ttyfd, &tty_con) == -1) {
891120
 	sudo_warn(U_("unable to get current tty context, not relabeling tty"));
891120
 	goto bad;
891120
     }
891120
 
891120
-    if (tty_con) {
891120
+    if (tty_con != NULL) {
891120
 	security_class_t tclass = string_to_security_class("chr_file");
891120
 	if (tclass == 0) {
891120
 	    sudo_warn(U_("unknown security class \"chr_file\", not relabeling tty"));
891120
 	    goto bad;
891120
 	}
891120
 	if (security_compute_relabel(se_state.new_context, tty_con,
891120
-	    tclass, &new_tty_con) < 0) {
891120
+	    tclass, &new_tty_con) == -1) {
891120
 	    sudo_warn(U_("unable to get new tty context, not relabeling tty"));
891120
 	    goto bad;
891120
 	}
891120
     }
891120
 
891120
     if (new_tty_con != NULL) {
891120
-	if (fsetfilecon(se_state.ttyfd, new_tty_con) < 0) {
891120
+	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: tty context %s -> %s",
891120
+	    __func__, tty_con, new_tty_con);
891120
+	if (fsetfilecon(se_state.ttyfd, new_tty_con) == -1) {
891120
 	    sudo_warn(U_("unable to set new tty context"));
891120
 	    goto bad;
891120
 	}
891120
@@ -276,12 +292,12 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
891120
     debug_decl(get_exec_context, SUDO_DEBUG_SELINUX)
891120
     
891120
     /* We must have a role, the type is optional (we can use the default). */
891120
-    if (!role) {
891120
+    if (role == NULL) {
891120
 	sudo_warnx(U_("you must specify a role for type %s"), type);
891120
 	errno = EINVAL;
891120
 	goto bad;
891120
     }
891120
-    if (!type) {
891120
+    if (type == NULL) {
891120
 	if (get_default_type(role, &typebuf)) {
891120
 	    sudo_warnx(U_("unable to get default type for role %s"), role);
891120
 	    errno = EINVAL;
891120
@@ -291,10 +307,13 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
891120
     }
891120
     
891120
     /* 
891120
-     * Expand old_context into a context_t so that we extract and modify 
891120
+     * Expand old_context into a context_t so that we can extract and modify 
891120
      * its components easily. 
891120
      */
891120
-    context = context_new(old_context);
891120
+    if ((context = context_new(old_context)) == NULL) {
891120
+	sudo_warn(U_("failed to get new context"));
891120
+	goto bad;
891120
+    }
891120
     
891120
     /*
891120
      * Replace the role and type in "context" with the role and
891120
@@ -316,24 +335,20 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
891120
 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
891120
 	goto bad;
891120
     }
891120
-    if (security_check_context(new_context) < 0) {
891120
+    if (security_check_context(new_context) == -1) {
891120
 	sudo_warnx(U_("%s is not a valid context"), new_context);
891120
 	errno = EINVAL;
891120
 	goto bad;
891120
     }
891120
 
891120
-#ifdef DEBUG
891120
-    sudo_warnx("Your new context is %s", new_context);
891120
-#endif
891120
-
891120
     context_free(context);
891120
-    debug_return_ptr(new_context);
891120
+    debug_return_str(new_context);
891120
 
891120
 bad:
891120
     free(typebuf);
891120
     context_free(context);
891120
     freecon(new_context);
891120
-    debug_return_ptr(NULL);
891120
+    debug_return_str(NULL);
891120
 }
891120
 
891120
 /* 
891120
@@ -352,40 +367,33 @@ selinux_setup(const char *role, const char *type, const char *ttyn,
891120
 
891120
     /* Store the caller's SID in old_context. */
891120
     if (getprevcon(&se_state.old_context)) {
891120
-	sudo_warn(U_("failed to get old_context"));
891120
+	sudo_warn(U_("failed to get old context"));
891120
 	goto done;
891120
     }
891120
 
891120
     se_state.enforcing = security_getenforce();
891120
-    if (se_state.enforcing < 0) {
891120
+    if (se_state.enforcing == -1) {
891120
 	sudo_warn(U_("unable to determine enforcing mode."));
891120
 	goto done;
891120
     }
891120
 
891120
-#ifdef DEBUG
891120
-    sudo_warnx("your old context was %s", se_state.old_context);
891120
-#endif
891120
+    sudo_debug_printf(SUDO_DEBUG_INFO, "%s: old context %s", __func__,
891120
+	se_state.old_context);
891120
     se_state.new_context = get_exec_context(se_state.old_context, role, type);
891120
-    if (!se_state.new_context) {
891120
+    if (se_state.new_context == NULL) {
891120
 #ifdef HAVE_LINUX_AUDIT
891120
-	audit_role_change(se_state.old_context, "?",
891120
-	  se_state.ttyn, 0);
891120
+	audit_role_change(se_state.old_context, "?", se_state.ttyn, 0);
891120
 #endif
891120
 	goto done;
891120
     }
891120
+    sudo_debug_printf(SUDO_DEBUG_INFO, "%s: new context %s", __func__,
891120
+	se_state.new_context);
891120
     
891120
-    if (relabel_tty(ttyn, ptyfd) < 0) {
891120
+    if (relabel_tty(ttyn, ptyfd) == -1) {
891120
 	sudo_warn(U_("unable to set tty context to %s"), se_state.new_context);
891120
 	goto done;
891120
     }
891120
 
891120
-#ifdef DEBUG
891120
-    if (se_state.ttyfd != -1) {
891120
-	sudo_warnx("your old tty context is %s", se_state.tty_context);
891120
-	sudo_warnx("your new tty context is %s", se_state.new_tty_context);
891120
-    }
891120
-#endif
891120
-
891120
 #ifdef HAVE_LINUX_AUDIT
891120
     audit_role_change(se_state.old_context, se_state.new_context,
891120
 	se_state.ttyn, 1);