Using get_default_context() for name = NULL instead of getseuserbyname because files

created in /var/spool/cron hadn't wrong context.
rhbz#426704

diff --git a/src/security.c b/src/security.c
index cae8e271af9f262cd14f9dbd90398a368b7a53f2..cdcc14b6009a898c40b001edd3e423881b93ea2f 100644 (file)
--- a/src/security.c
+++ b/src/security.c
@@ -459,24 +459,26 @@ int get_security_context( const char *name,
        if (is_selinux_enabled() <= 0) 
            return 0;
 
-       if (getseuserbyname(name, &seuser, &level) == 0) {
-               retval=get_default_context_with_level(seuser, level, NULL, &scontext);
-               free(seuser);
-               free(level);
-               if (retval) {
-                       if (security_getenforce() > 0) {
-                               log_it(name, getpid(), "No SELinux security context",tabname);
-                               return -1;
-                       } else {
-                               log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
-                               return 0;
-                       }
+       if (name != NULL) {
+               if (getseuserbyname(name, &seuser, &level) < 0) {
+                       log_it(name, getpid(), "getseuserbyname FAILED", name);
+               return (security_getenforce() > 0);
                }
-       } else {
-               log_it(name, getpid(), "getseusername FAILED", name);
-               return (security_getenforce() > 0);
        }
-       
+
+       retval=get_default_context_with_level(name == NULL ? "system_u" : seuser, level, NULL, &scontext);
+       free(seuser);
+       free(level);
+       if (retval) {
+               if (security_getenforce() > 0) {
+                       log_it(name, getpid(), "No SELinux security context",tabname);
+                       return -1;
+               } else {
+                       log_it(name, getpid(), "No security context but SELinux in permissive mode, continuing",tabname);
+                       return 0;
+               }
+       }
+
        if (fgetfilecon(crontab_fd, &file_context) < OK) {
                if (security_getenforce() > 0) {
                        log_it(name, getpid(), "getfilecon FAILED", tabname);

diff --git a/src/user.c b/src/user.c
index ac6cfeb4baa3345f4f6336716776b436cd18908b..48e30202c2ef47cc7e5d7f1bc932ba24cd9a7b79 100644 (file)
--- a/src/user.c
+++ b/src/user.c
@@ -91,7 +91,7 @@ load_user(int crontab_fd, struct passwd       *pw, const char *uname, const char *fnam
                return (NULL);
        }
 
-       if (get_security_context(pw == NULL ? "system_u" : uname, 
+       if (get_security_context(pw == NULL ? NULL : uname, 
                                 crontab_fd, 
                                 &u->scontext, tabname) != 0) {
            free_user(u);