merged SE Linux support

diff --git a/conf.c b/conf.c
index 461d5353b82561502a3fa2a20daf08d922f50bde..f4bd7518ae7adc20c4e70fedc1b63a87f28b5048 100644 (file)
--- a/conf.c
+++ b/conf.c
@@ -22,7 +22,7 @@
  *  `LICENSE' that comes with the fcron source distribution.
  */
 
- /* $Id: conf.c,v 1.64 2002-11-17 13:13:46 thib Exp $ */
+ /* $Id: conf.c,v 1.65 2003-07-14 10:52:21 thib Exp $ */
 
 #include "fcron.h"
 
@@ -437,6 +437,13 @@ read_file(const char *file_name, cf_t *cf)
     struct passwd *pass = NULL;
     short int type = 0, size = 0;
     int rc;
+#ifdef CONFIG_FLASK
+    int flask_enabled = is_flask_enabled();
+    struct security_query qry;
+    struct security_response rsp;
+    int retval;
+    const char *user_name;
+#endif
 
     /* open file */
     if ( (ff = fopen(file_name, "r")) == NULL ) {
@@ -446,6 +453,11 @@ read_file(const char *file_name, cf_t *cf)
 
     /* check if this file is owned by root : otherwise, all runas fields
      * of this field should be set to the owner */
+#ifdef CONFIG_FLASK
+    if(flask_enabled)
+       rc = fstat_secure(fileno(ff), &file_stat, &cf->cf_file_sid);
+    else
+#endif
     rc = fstat(fileno(ff), &file_stat);
     if ( rc != 0 ) {
        error_e("Could not stat %s", file_name);
@@ -467,8 +479,11 @@ read_file(const char *file_name, cf_t *cf)
            }
            runas_str = strdup2(pass->pw_name);
        }
+       cf->cf_user = strdup2(file_name + 4);
     }
     else {
+       if(!cf->cf_user)
+           cf->cf_user = strdup2(file_name);
        if ( file_stat.st_uid == ROOTUID ) {
            /* file is owned by root : either this file has already been parsed
             * at least once by fcron, or it is root's fcrontab */
@@ -480,6 +495,32 @@ read_file(const char *file_name, cf_t *cf)
        }
     }
 
+#ifdef CONFIG_FLASK
+    /*
+     * Since crontab files are not directly executed,
+     * crond must ensure that the crontab file has
+     * a context that is appropriate for the context of
+     * the user cron job.  It performs an entrypoint
+     * permission check for this purpose.
+     */
+    if(!strcmp(cf->cf_user, SYSFCRONTAB))
+       user_name = "system_u";
+    else
+       user_name = cf->cf_user;
+    if(get_default_sid(user_name, 0, &cf->cf_user_sid))
+       error_e("NO SID for user \"%s\"", cf->cf_user_sid);
+    qry.ssid = cf->cf_user_sid;
+    qry.tsid = cf->cf_file_sid;
+    qry.tclass = SECCLASS_FILE;
+    qry.requested = FILE__ENTRYPOINT;
+    retval = security_compute_av(&qry, &rsp);
+    if(retval || ((qry.requested & rsp.allowed) != qry.requested)) {
+       syslog(LOG_ERR, "ENTRYPOINT FAILED for \"%s\" (SID %u) for file SID %u"
+              , cf->cf_user, cf->cf_user_sid, cf->cf_file_sid);
+       goto err;
+    }
+#endif
+
     debug("User %s Entry", file_name);
     bzero(buf, sizeof(buf));
 
@@ -501,6 +542,8 @@ read_file(const char *file_name, cf_t *cf)
        goto err;
     }
     /* get the owner's name */
+    /* we set cf->cf_user before for SE Linux, so we need to free it here */
+    free(cf->cf_user);
     if ( read_strn(fileno(ff), &cf->cf_user, size) != OK ) {
        error("Cannot read user's name : file ignored");
        goto err;

diff --git a/config.h.in b/config.h.in
index 11ce69829fd1be957fcf779613ed05aa14b2fd1e..39927e949942437591c3a59d0784ad5cc0f6880b 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -21,7 +21,7 @@
  *  `LICENSE' that comes with the fcron source distribution.
  */
 
- /* $Id: config.h.in,v 1.47 2002-10-28 17:54:56 thib Exp $ */
+ /* $Id: config.h.in,v 1.48 2003-07-14 10:53:22 thib Exp $ */
 
 
 /* *********************************************************** */
@@ -389,5 +389,8 @@
 /* Define if you have the shadow library (-lshadow or included in c library).  */
 #undef HAVE_LIBSHADOW
 
+/* Have SE Linux support */
+#undef CONFIG_FLASK
+
 /* Define if you have the xnet library (-lxnet).  */
 #undef HAVE_LIBXNET

diff --git a/configure.in b/configure.in
index e0b847a4c2a9d2b1b79120d387bb3983a7e73e9f..3e34bc0e33656a50e01424d568bc2de819424cd3 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -11,7 +11,7 @@ if test \( "$prefix" = "NONE" \) -o \( -z "$prefix" \); then
 fi
 AC_PREFIX_DEFAULT($prefix)
 AC_CONFIG_HEADER(config.h)
-AC_PREREQ(2.7)
+AC_PREREQ(2.57)
 
 vers="2.9.4"
 vers_quoted="\"$vers\""
@@ -44,6 +44,7 @@ AC_CHECK_HEADERS(strings.h)
 AC_CHECK_HEADERS(sys/types.h sys/socket.h sys/un.h)
 AC_CHECK_HEADERS(security/pam_appl.h crypt.h shadow.h)
 AC_CHECK_HEADERS(sys/resource.h)
+AC_CHECK_HEADERS(flask_util.h)
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
@@ -60,6 +61,7 @@ AC_TYPE_SIGNAL
 AC_FUNC_STRFTIME
 AC_FUNC_WAIT3
 AC_CHECK_LIB(xnet, shutdown)
+AC_CHECK_LIB(secure, getsecsid, [flaskavail=1], [flaskavail=0])
 AC_CHECK_FUNC(getloadavg, [getloadavg=1], [getloadavg=0])
 AC_CHECK_LIB(kstat, kstat_open, [kstat=1], [kstat=0])
 if test $getloadavg -eq 1; then
@@ -70,7 +72,7 @@ dnl Nothing to do ...
 elif test $kstat -eq 1;  then
   AC_MSG_CHECKING(function to use for lavg* options)  
   LIBS="$LIBS -lkstat"
-  LIBOBJS="$LIBOBJS getloadavg.o"
+  AC_LIBOBJ([getloadavg])
   AC_DEFINE_UNQUOTED(HAVE_KSTAT, 1)
   AC_MSG_RESULT(kstat)
 else
@@ -596,6 +598,44 @@ USEPAM="$usepam"
 AC_SUBST(USEPAM)
 
 
+AC_MSG_CHECKING(if SELinux should be used)
+AC_ARG_WITH(selinux,
+[ --with-selinux=[yes|no]      Use (or not) SELinux (default: yes).],
+[ case "$withval" in
+  no)
+    useselinux=0
+    AC_MSG_RESULT(no)
+    ;;
+  yes)
+    if test "$flaskavail" -eq 1; then
+       useselinux=1
+       AC_MSG_RESULT(yes)
+    else
+       AC_MSG_RESULT(not available)
+        AC_MSG_ERROR([
+  You requested the use of SELinux, but SELinux is considered 
+  as not available by configure script.
+])
+    fi
+    ;;
+  *)
+    AC_MSG_ERROR(Must be set to either "yes" or "no".)
+    ;;
+  esac ],
+  if test "$flaskavail" -eq 1; then
+    useselinux=1
+    AC_MSG_RESULT(yes)
+  else
+    useselinux=0
+    AC_MSG_RESULT(not available)
+  fi
+)
+if test "$useselinux" -eq 1; then
+  LIBS="$LIBS -lsecure"
+  AC_DEFINE(CONFIG_FLASK)
+fi
+
+
 dnl ---------------------------------------------------------------------
 dnl Users and groups ...
 
@@ -979,7 +1019,7 @@ AC_SUBST(DB2MAN_BEFORE)
 AC_SUBST(DB2MAN_AFTER)
 
 
-DSSSL_DIR="/usr/share/sgml/docbook/dsssl-stylesheets-1.74b/"
+DSSSL_DIR="/usr/share/sgml/docbook/stylesheet/dsssl/modular"
 
 AC_MSG_CHECKING(Looking for dsssl stylsheets)
 AC_ARG_WITH(dsssl-dir,

diff --git a/global.h b/global.h
index 136cf75be28e7221a9e63acb51afb168ce2a68d2..ebac60595666084a3ec7fce65c20b829e8e2b32a 100644 (file)
--- a/global.h
+++ b/global.h
@@ -21,7 +21,7 @@
  *  `LICENSE' that comes with the fcron source distribution.
  */
 
- /* $Id: global.h,v 1.39 2002-10-28 17:53:59 thib Exp $ */
+ /* $Id: global.h,v 1.40 2003-07-14 10:51:52 thib Exp $ */
 
 
 /* 
@@ -43,10 +43,22 @@
 #include <errno.h>
 #endif
 
+#ifdef CONFIG_FLASK
+#include <flask_util.h>
+#include <fs_secure.h>
+#include <ss.h>
+#include <linux/flask/av_permissions.h>
+#include <get_sid_list.h>
+#endif
+
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
 
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
+
 #include <pwd.h>
 #include <signal.h>
 
@@ -97,10 +109,6 @@
 #include <sys/fcntl.h>
 #endif
 
-#ifdef HAVE_LIMITS_H
-#include <limits.h>
-#endif
-
 #ifdef HAVE_LIBPAM
 #include "pam.h"
 #endif
@@ -159,6 +167,10 @@ typedef struct cf_t {
     struct env_t *cf_env_base;  /* list of all env variables to set          */
     int                  cf_running;   /* number of jobs running                    */
     signed char          cf_tzdiff;    /* time diff between system and local hour   */
+#ifdef CONFIG_FLASK
+    security_id_t cf_user_sid;
+    security_id_t cf_file_sid;
+#endif
 } cf_t;