Revert "Cache the security class and bit values and translate the remaining hardcoded...

Caching cannot be done as the values can change on SELinux policy update.

This reverts commit b15f72976965d2ae1a1273558bf45be7de077b79.

diff --git a/src/cron.c b/src/cron.c
index ac9bba7dd2f9e7d3194b641025463f2ba82c953c..9159164df7b7f226fe3c963017dffc0ded004066 100644 (file)
--- a/src/cron.c
+++ b/src/cron.c
@@ -198,10 +198,6 @@ int main(int argc, char *argv[]) {
                exit(1);
        }
 
-       if (cron_init_security() < 0) {
-               log_it("CRON", pid, "DEATH", "Critical security parameters not initialized", 0);
-       }
-
        /* Get the default locale character set for the mail 
         * "Content-Type: ...; charset=" header
         */

diff --git a/src/funcs.h b/src/funcs.h
index a1645e90c6bc6d6f1c923f4c99291c0547ba8b7a..fabd0b27a28f49bcb9f413d549ab9facc1b67362 100644 (file)
--- a/src/funcs.h
+++ b/src/funcs.h
@@ -85,8 +85,6 @@ long          get_gmtoff(time_t *, struct tm *);
 
 /* Red Hat security stuff (security.c): 
  */
-int cron_init_security( void );
-
 void cron_restore_default_security_context( void );
 
 int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );

diff --git a/src/security.c b/src/security.c
index 65cea73dbc7c3f7837fcc1ace7890d47d74ccc63..3ea7a1f0d7a6f9d5676765dc17be0d26544293e7 100644 (file)
--- a/src/security.c
+++ b/src/security.c
@@ -80,11 +80,6 @@ static char **build_env(char **cronenv);
 static int cron_change_selinux_range(user * u, security_context_t ucontext);
 static int cron_get_job_range(user * u, security_context_t * ucontextp,
        char **jobenv);
-
-static security_class_t file_class;
-static security_class_t context_class;
-static access_vector_t entrypoint_bit;
-static access_vector_t contains_bit;
 #endif
 
 void cron_restore_default_security_context() {
@@ -93,40 +88,6 @@ void cron_restore_default_security_context() {
 #endif
 }
 
-int cron_init_security() {
-#ifdef WITH_SELINUX
-       int rv = -1;
-
-       if (is_selinux_enabled() <= 0)
-               return 0;
-
-       if (security_getenforce() <= 0)
-               rv = 0;
-
-       file_class = string_to_security_class("file");
-       if (!file_class) {
-               log_it("CRON", getpid(), "ERROR", "Failed to translate security class file", errno);
-               return rv;
-       }
-       context_class = string_to_security_class("context");
-       if (!context_class) {
-               log_it("CRON", getpid(), "ERROR", "Failed to translate security class context", errno);
-               return rv;
-       }
-       entrypoint_bit = string_to_av_perm(file_class, "entrypoint");
-       if (!entrypoint_bit) {
-               log_it("CRON", getpid(), "ERROR", "Failed to translate av perm entrypoint", errno);
-               return rv;
-       }
-       contains_bit = string_to_av_perm(context_class, "contains");
-       if (!contains_bit) {
-               log_it("CRON", getpid(), "ERROR", "Failed to translate av perm contains", errno);
-               return rv;
-       }
-#endif
-       return 0;
-}
-
 int cron_set_job_security_context(entry * e, user * u, char ***jobenv) {
        time_t minutely_time = 0;
 #ifdef WITH_PAM
@@ -293,6 +254,12 @@ static int cron_authorize_context(security_context_t scontext,
        struct av_decision avd;
        int retval;
 
+       security_class_t tclass = string_to_security_class("file");
+       if (!tclass)
+               return 0;
+       access_vector_t bit = string_to_av_perm(tclass, "entrypoint");
+       if (!bit)
+               return 0;
        /*
         * Since crontab files are not directly executed,
         * crond must ensure that the crontab file has
@@ -300,11 +267,9 @@ static int cron_authorize_context(security_context_t scontext,
         * the user cron job.  It performs an entrypoint
         * permission check for this purpose.
         */
-       if (!file_class || !entrypoint_bit)
-               return 0;
        retval = security_compute_av(scontext, file_context,
-               file_class, entrypoint_bit, &avd);
-       if (retval || ((entrypoint_bit & avd.allowed) != entrypoint_bit))
+               tclass, bit, &avd);
+       if (retval || ((bit & avd.allowed) != bit))
                return 0;
 #endif
        return 1;
@@ -315,17 +280,16 @@ static int cron_authorize_range(security_context_t scontext,
 #ifdef WITH_SELINUX
        struct av_decision avd;
        int retval;
+       unsigned int bit = CONTEXT__CONTAINS;
        /*
         * Since crontab files are not directly executed,
         * so crond must ensure that any user specified range
         * falls within the seusers-specified range for that Linux user.
         */
-       if (!context_class || !contains_bit)
-               return 0;
        retval = security_compute_av(scontext, ucontext,
-               context_class, contains_bit, &avd);
+               SECCLASS_CONTEXT, bit, &avd);
 
-       if (retval || ((contains_bit & avd.allowed) != contains_bit))
+       if (retval || ((bit & avd.allowed) != bit))
                return 0;
 #endif
        return 1;
@@ -563,30 +527,22 @@ int crontab_security_access(void) {
                security_context_t user_context;
                if (getprevcon_raw(&user_context) == 0) {
                        security_class_t passwd_class;
-                       access_vector_t crontab_bit;
                        struct av_decision avd;
-                       int retval = 0;
+                       int retval;
 
                        passwd_class = string_to_security_class("passwd");
                        if (passwd_class == 0) {
+                               selinux_check_passwd_access = -1;
                                fprintf(stderr, "Security class \"passwd\" is not defined in the SELinux policy.\n");
-                               retval = -1;
-                       }
-
-                       if (retval == 0) {
-                               crontab_bit = string_to_av_perm(passwd_class, "crontab");
-                               if (crontab_bit == 0) {
-                                       fprintf(stderr, "Security av permission \"crontab\" is not defined in the SELinux policy.\n");
-                                       retval = -1;
-                               }
                        }
 
-                       if (retval == 0)
-                               retval = security_compute_av_raw(user_context,
-                                       user_context, passwd_class,
-                                       crontab_bit, &avd);
+                       retval = security_compute_av_raw(user_context,
+                                                       user_context,
+                                                       passwd_class,
+                                                       PASSWD__CRONTAB,
+                                                       &avd);
 
-                       if ((retval == 0) && ((crontab_bit & avd.allowed) == crontab_bit)) {
+                       if ((retval == 0) && ((PASSWD__CRONTAB & avd.allowed) == PASSWD__CRONTAB)) {
                                selinux_check_passwd_access = 0;
                        }
                        freecon(user_context);