|
 |
cc5661 |
From 48c4085004caad1ec928fa103b7f3e3fe684c826 Mon Sep 17 00:00:00 2001
|
|
|
cc5661 |
From: Petr Lautrbach <plautrba@redhat.com>
|
|
|
cc5661 |
Date: Apr 07 2020 11:16:48 +0000
|
|
|
cc5661 |
Subject: Do not use deprecated flask.h and av_permissions.h
|
|
|
cc5661 |
|
|
|
cc5661 |
|
|
|
cc5661 |
selinux/flask.h and selinux/av_permissions.h will be completely dropped in the
|
|
|
cc5661 |
next SELinux release.
|
|
|
cc5661 |
|
|
|
cc5661 |
Use string_to_security_class() and string_to_av_perm() to get class and
|
|
|
cc5661 |
permission values. The original hardcoded values could be invalid and are
|
|
|
cc5661 |
deprecated as the whole flask.h and av_permissions.h header files.
|
|
|
cc5661 |
|
|
|
cc5661 |
---
|
|
|
cc5661 |
|
|
|
cc5661 |
diff --git a/userhelper.c b/userhelper.c
|
|
|
cc5661 |
index 4177c89..f2afde7 100644
|
|
|
cc5661 |
--- a/userhelper.c
|
|
|
cc5661 |
+++ b/userhelper.c
|
|
|
cc5661 |
@@ -48,8 +48,6 @@
|
|
|
cc5661 |
|
|
|
cc5661 |
#ifdef WITH_SELINUX
|
|
|
cc5661 |
#include <selinux/selinux.h>
|
|
|
cc5661 |
-#include <selinux/flask.h>
|
|
|
cc5661 |
-#include <selinux/av_permissions.h>
|
|
|
cc5661 |
#endif
|
|
|
cc5661 |
|
|
|
cc5661 |
#include "shvar.h"
|
|
|
cc5661 |
@@ -111,7 +109,7 @@ static int checkAccess(unsigned int selaccess) {
|
|
|
cc5661 |
struct av_decision avd;
|
|
|
cc5661 |
int retval = security_compute_av(user_context,
|
|
|
cc5661 |
user_context,
|
|
|
cc5661 |
- SECCLASS_PASSWD,
|
|
|
cc5661 |
+ string_to_security_class("passwd"),
|
|
|
cc5661 |
selaccess,
|
|
|
cc5661 |
&avd);
|
|
|
cc5661 |
|
|
|
cc5661 |
@@ -2267,7 +2265,8 @@ main(int argc, char **argv)
|
|
|
cc5661 |
const char *new_home_phone;
|
|
|
cc5661 |
const char *new_shell;
|
|
|
cc5661 |
#ifdef WITH_SELINUX
|
|
|
cc5661 |
- unsigned perm;
|
|
|
cc5661 |
+ security_class_t class;
|
|
|
cc5661 |
+ access_vector_t perm;
|
|
|
cc5661 |
#endif
|
|
|
cc5661 |
|
|
|
cc5661 |
/* State variable we pass around. */
|
|
|
cc5661 |
@@ -2426,12 +2425,13 @@ main(int argc, char **argv)
|
|
|
cc5661 |
user_name = g_strdup(argv[optind]);
|
|
|
cc5661 |
|
|
|
cc5661 |
#ifdef WITH_SELINUX
|
|
|
cc5661 |
+ class = string_to_security_class("passwd");
|
|
|
cc5661 |
if (c_flag)
|
|
|
cc5661 |
- perm = PASSWD__PASSWD;
|
|
|
cc5661 |
+ perm = string_to_av_perm(class, "passwd");
|
|
|
cc5661 |
else if (s_flag)
|
|
|
cc5661 |
- perm = PASSWD__CHSH;
|
|
|
cc5661 |
+ perm = string_to_av_perm(class, "chsh");
|
|
|
cc5661 |
else
|
|
|
cc5661 |
- perm = PASSWD__CHFN;
|
|
|
cc5661 |
+ perm = string_to_av_perm(class, "chfn");
|
|
|
cc5661 |
|
|
|
cc5661 |
if (is_selinux_enabled() > 0 &&
|
|
|
cc5661 |
checkAccess(perm)!= 0) {
|
|
|
cc5661 |
|