* NEW, src/vipw.c: SE Linux: Set the default context to the

	context of the file being edited. This ensures that the backup
	file inherit from the file's context.

diff --git a/ChangeLog b/ChangeLog
index 4e010501c9f702c644090a4e7acbc508a71e31ab..7abd8cf19535175e6d74144948f9bd31de712853 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2009-04-15  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEW, src/vipw.c: SE Linux: Set the default context to the
+       context of the file being edited. This ensures that the backup
+       file inherit from the file's context.
+
 2009-04-14  Nicolas François  <nicolas.francois@centraliens.net>
 
        * man/usermod.8.xml: There are no default values for --inactive

diff --git a/NEWS b/NEWS
index 1a1ea3fdbb7d031fdceae8bcf3b10b625b05400e..8f96308d01f8c5d7a31db92f946fdbbcf5dd64d6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,12 @@
 $Id$
 
+shadow-4.1.3 -> shadow-4.1.3.1                                         UNRELEASED
+
+- vipw
+  * SE Linux: Set the default context to the context of the file being
+    edited. This ensures that the backup file inherit from the file's
+    context.
+
 shadow-4.1.2.2 -> shadow-4.1.3                                         2009-04-12
 
 *** general:

diff --git a/src/vipw.c b/src/vipw.c
index f7d0e63f3402516fe465e5660ae31d7130325a65..116a199c0d86f26e2693632c45f5c9795d4a50ac 100644 (file)
--- a/src/vipw.c
+++ b/src/vipw.c
@@ -45,6 +45,10 @@
 #include "sgroupio.h"
 #include "shadowio.h"
 
+#ifdef WITH_SELINUX                                                            
+#include <selinux/selinux.h>                                                   
+#endif
+
 #define MSG_WARN_EDIT_OTHER_FILE _( \
        "You have modified %s.\n"\
        "You may need to modify %s for consistency.\n"\
@@ -189,6 +193,22 @@ vipwedit (const char *file, int (*file_lock) (void), int (*file_unlock) (void))
        if (access (file, F_OK) != 0) {
                vipwexit (file, 1, 1);
        }
+#ifdef WITH_SELINUX
+       /* if SE Linux is enabled then set the context of all new files
+          to be the context of the file we are editing */
+       if (is_selinux_enabled ()) {
+               security_context_t passwd_context=NULL;
+               int ret = 0;
+               if (getfilecon (file, &passwd_context) < 0) {
+                       vipwexit (_("Couldn't get file context"), errno, 1);
+               }
+               ret = setfscreatecon (passwd_context);
+               freecon (passwd_context);
+               if (0 != ret) {
+                       vipwexit (_("setfscreatecon () failed"), errno, 1);
+               }
+       }
+#endif
        if (file_lock () == 0) {
                vipwexit (_("Couldn't lock file"), errno, 5);
        }
@@ -260,6 +280,14 @@ vipwedit (const char *file, int (*file_lock) (void), int (*file_unlock) (void))
        if (st1.st_mtime == st2.st_mtime) {
                vipwexit (0, 0, 0);
        }
+#ifdef WITH_SELINUX                                                            
+       /* unset the fscreatecon */                                             
+       if (is_selinux_enabled ()) {
+               if (setfscreatecon (NULL)) {
+                       vipwexit (_("setfscreatecon() failed"), errno, 1);
+               }
+       }
+#endif
 
        /*
         * XXX - here we should check fileedit for errors; if there are any,