Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 471338 Details for
Bug 617074
sys-process/vixie-cron fixed SELinux support
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
vixie-cron-4.1-selinux-2.patch
vixie-cron-4.1-selinux-2.patch (text/plain), 6.41 KB, created by
Jason Zaman
on 2017-04-30 03:07:40 UTC
(
hide
)
Description:
vixie-cron-4.1-selinux-2.patch
Filename:
MIME Type:
Creator:
Jason Zaman
Created:
2017-04-30 03:07:40 UTC
Size:
6.41 KB
patch
obsolete
>diff -ur vixie-cron-4.1/Makefile vixie-cron-4.1-selinux/Makefile >--- vixie-cron-4.1/Makefile 2004-08-28 02:09:33.000000000 +0800 >+++ vixie-cron-4.1-selinux/Makefile 2017-04-26 22:16:53.321394815 +0800 >@@ -68,7 +68,8 @@ > #<<want to use a nonstandard CC?>> > CC = gcc -Wall -Wno-unused -Wno-comment > #<<manifest defines>> >-DEFS = >+DEFS = -s -DWITH_SELINUX >+LIBS += -lselinux > #(SGI IRIX systems need this) > #DEFS = -D_BSD_SIGNALS -Dconst= > #<<the name of the BSD-like install program>> >diff -ur vixie-cron-4.1/database.c vixie-cron-4.1-selinux/database.c >--- vixie-cron-4.1/database.c 2004-08-28 02:09:34.000000000 +0800 >+++ vixie-cron-4.1-selinux/database.c 2017-04-27 01:31:34.757942605 +0800 >@@ -28,6 +28,15 @@ > > #include "cron.h" > >+#ifdef WITH_SELINUX >+#include <selinux/selinux.h> >+#include <selinux/context.h> >+#include <selinux/get_context_list.h> >+#define SYSUSERNAME "system_u" >+#else >+#define SYSUSERNAME "*system*" >+#endif >+ > #define TMAX(a,b) ((a)>(b)?(a):(b)) > > static void process_crontab(const char *, const char *, >@@ -183,7 +192,7 @@ > if (fname == NULL) { > /* must be set to something for logging purposes. > */ >- fname = "*system*"; >+ fname = SYSUSERNAME; > } else if ((pw = getpwnam(uname)) == NULL) { > /* file doesn't have a user in passwd file. > */ >@@ -245,6 +254,117 @@ > free_user(u); > log_it(fname, getpid(), "RELOAD", tabname); > } >+#ifdef WITH_SELINUX >+ if (is_selinux_enabled()) { >+ security_context_t file_context=NULL; >+ security_context_t user_context=NULL; >+ context_t current_context = NULL; >+ char *current_context_str = NULL; >+ struct av_decision avd; >+ int retval=0; >+ char *seuser=NULL; >+ char *level=NULL; >+ int sys_user = 0; >+ >+ sys_user = strcmp(SYSUSERNAME, fname); >+ >+ if (fgetfilecon(crontab_fd, &file_context) < OK) { >+ log_it(fname, getpid(), "getfilecon FAILED", tabname); >+ goto next_crontab; >+ } >+ >+ if (sys_user != 0) { >+ if (getseuserbyname(fname, &seuser, &level) < 0) { >+ log_it(fname, getpid(), "NO SEUSER", tabname); >+ goto next_crontab; >+ } >+ } else { >+ if (getcon(¤t_context_str) < 0) { >+ log_it(fname, getpid(), "getcon FAILED", tabname); >+ goto next_crontab; >+ } >+ >+ current_context = context_new(current_context_str); >+ if (current_context == 0) { >+ log_it(fname, getpid(), "context new FAILED", tabname); >+ freecon(current_context_str); >+ goto next_crontab; >+ } >+ >+ seuser = context_user_get(current_context); >+ level = context_range_get(current_context); >+ } >+ >+ if (get_default_context_with_level(seuser, level, NULL, &user_context) < 0) { >+ log_it(fname, getpid(), "NO CONTEXT", tabname); >+ freecon(file_context); >+ if (sys_user != 0) { >+ free(seuser); >+ free(level); >+ } >+ freecon(current_context_str); >+ context_free(current_context); >+ goto next_crontab; >+ } >+ >+ /* >+ * Since crontab files are not directly executed, >+ * crond must ensure that the crontab file has >+ * a context that is appropriate for the context of >+ * the user cron job. It performs an entrypoint >+ * permission check for this purpose. >+ */ >+ security_class_t file_class; >+ access_vector_t entrypoint_bit; >+ file_class = string_to_security_class("file"); >+ if (file_class == 0) { >+ log_it(fname, getpid(), "file CLASS NOT DEFINED", tabname); >+ freecon(current_context_str); >+ context_free(current_context); >+ freecon(user_context); >+ freecon(file_context); >+ if (sys_user != 0) { >+ free(seuser); >+ free(level); >+ } >+ goto next_crontab; >+ } >+ >+ entrypoint_bit = string_to_av_perm(file_class, "entrypoint"); >+ if (entrypoint_bit == 0) { >+ log_it(fname, getpid(), "file:entrypoint AV NOT DEFINED", tabname); >+ freecon(current_context_str); >+ context_free(current_context); >+ freecon(user_context); >+ freecon(file_context); >+ if (sys_user != 0) { >+ free(seuser); >+ free(level); >+ } >+ goto next_crontab; >+ } >+ >+ retval = security_compute_av_raw(user_context, >+ file_context, >+ file_class, >+ entrypoint_bit, >+ &avd); >+ >+ freecon(user_context); >+ freecon(file_context); >+ if (sys_user != 0) { >+ free(seuser); >+ free(level); >+ } >+ context_free(current_context); >+ freecon(current_context_str); >+ >+ if (retval || ((entrypoint_bit & avd.allowed) != entrypoint_bit)) { >+ log_it(fname, getpid(), "ENTRYPOINT FAILED", tabname); >+ goto next_crontab; >+ } >+ } >+#endif > u = load_user(crontab_fd, pw, fname); > if (u != NULL) { > u->mtime = statbuf->st_mtime; >diff -ur vixie-cron-4.1/do_command.c vixie-cron-4.1-selinux/do_command.c >--- vixie-cron-4.1/do_command.c 2004-08-28 02:09:34.000000000 +0800 >+++ vixie-cron-4.1-selinux/do_command.c 2017-04-27 01:30:49.045144698 +0800 >@@ -25,6 +25,12 @@ > > #include "cron.h" > >+#ifdef WITH_SELINUX >+#include <selinux/selinux.h> >+#include <selinux/context.h> >+#include <selinux/get_context_list.h> >+#endif >+ > static void child_process(entry *, user *); > static int safe_p(const char *, const char *); > >@@ -265,6 +271,49 @@ > _exit(OK_EXIT); > } > # endif /*DEBUGGING*/ >+#ifdef WITH_SELINUX >+ if (is_selinux_enabled()) { >+ char *seuser = NULL; >+ char *level = NULL; >+ char *current_context_str = NULL; >+ security_context_t scontext; >+ context_t current_context = NULL; >+ >+ if (strcmp("system_u", u->name) != 0) { >+ if (getseuserbyname(u->name, &seuser, &level) < 0) { >+ fprintf(stderr, "getseuserbyname: Could not determine seuser for user %s\n", u->name); >+ _exit(ERROR_EXIT); >+ } >+ } else { >+ if (getcon(¤t_context_str) < 0) { >+ fprintf(stderr, "getcon FAILED\n"); >+ _exit(ERROR_EXIT); >+ } >+ >+ current_context = context_new(current_context_str); >+ if (current_context == NULL) { >+ fprintf(stderr, "failed to create new context: %s\n", current_context_str); >+ freecon(current_context_str); >+ _exit(ERROR_EXIT); >+ } >+ >+ seuser = context_user_get(current_context); >+ } >+ >+ if (get_default_context_with_level(seuser, level, NULL, &scontext) < 0) { >+ fprintf(stderr, "get_default_context_with_level: could not get security context for user %s, seuser %s\n", u->name, seuser); >+ _exit(ERROR_EXIT); >+ } >+ >+ if (setexeccon(scontext) < 0) { >+ fprintf(stderr, "setexeccon: Could not set exec context to %s for user %s\n", scontext, u->name); >+ _exit(ERROR_EXIT); >+ } >+ free(seuser); >+ free(level); >+ freecon(scontext); >+ } >+#endif > execle(shell, shell, "-c", e->cmd, (char *)0, e->envp); > fprintf(stderr, "execl: couldn't exec `%s'\n", shell); > perror("execl");
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 617074
: 471338