From: thib Date: Thu, 29 Jan 2004 10:28:51 +0000 (+0000) Subject: use new selinux X-Git-Tag: ver2_9_5~39 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6c3adeba602f3cd0a5ec0f1e1db3929767816f64;p=fcron use new selinux --- diff --git a/conf.c b/conf.c index 7df7c72..7b5795c 100644 --- a/conf.c +++ b/conf.c @@ -22,7 +22,7 @@ * `LICENSE' that comes with the fcron source distribution. */ - /* $Id: conf.c,v 1.66 2003-12-25 22:43:57 thib Exp $ */ + /* $Id: conf.c,v 1.67 2004-01-29 10:33:19 thib Exp $ */ #include "fcron.h" @@ -437,11 +437,10 @@ read_file(const char *file_name, cf_t *cf) struct passwd *pass = NULL; short int type = 0, size = 0; int rc; -#ifdef CONFIG_FLASK - int flask_enabled = is_flask_enabled(); - struct security_query qry; - struct security_response rsp; +#ifdef WITH_SELINUX + int flask_enabled = is_selinux_enabled(); int retval; + struct av_decision avd; const char *user_name; #endif @@ -453,16 +452,18 @@ read_file(const char *file_name, cf_t *cf) /* check if this file is owned by root : otherwise, all runas fields * of this field should be set to the owner */ -#ifdef CONFIG_FLASK - if(flask_enabled) - rc = fstat_secure(fileno(ff), &file_stat, &cf->cf_file_sid); - else -#endif rc = fstat(fileno(ff), &file_stat); if ( rc != 0 ) { error_e("Could not stat %s", file_name); goto err; } +#ifdef WITH_SELINUX + if(flask_enabled && fgetfilecon(fileno(ff), &cf->cf_file_context) < 0 ) + { + error_e("Could not get context of %s", file_name); + goto err; + } +#endif if ( strncmp(file_name,"new.", 4) == 0 ) { if ( file_stat.st_uid == ROOTUID ) { @@ -495,7 +496,7 @@ read_file(const char *file_name, cf_t *cf) } } -#ifdef CONFIG_FLASK +#ifdef WITH_SELINUX /* * Since crontab files are not directly executed, * crond must ensure that the crontab file has @@ -507,17 +508,20 @@ read_file(const char *file_name, cf_t *cf) user_name = "system_u"; else user_name = cf->cf_user; - if(get_default_sid(user_name, 0, &cf->cf_user_sid)) - error_e("NO SID for user \"%s\"", cf->cf_user_sid); - qry.ssid = cf->cf_user_sid; - qry.tsid = cf->cf_file_sid; - qry.tclass = SECCLASS_FILE; - qry.requested = FILE__ENTRYPOINT; - retval = security_compute_av(&qry, &rsp); - if(retval || ((qry.requested & rsp.allowed) != qry.requested)) { - syslog(LOG_ERR, "ENTRYPOINT FAILED for \"%s\" (SID %u) for file SID %u" - , cf->cf_user, cf->cf_user_sid, cf->cf_file_sid); - goto err; + if(flask_enabled) + { + if(get_default_context(user_name, NULL, &cf->cf_user_context)) + error_e("NO CONTEXT for user \"%s\"", cf->cf_user_context); + retval = security_compute_av(cf->cf_user_context, cf->cf_file_context + , SECCLASS_FILE, FILE__ENTRYPOINT, &avd); + + if(retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) + { + syslog(LOG_ERR, "ENTRYPOINT FAILED for user \"%s\" " + "(CONTEXT %s) for file CONTEXT %s" + , cf->cf_user, cf->cf_user_context, cf->cf_file_context); + goto err; + } } #endif @@ -525,7 +529,7 @@ read_file(const char *file_name, cf_t *cf) bzero(buf, sizeof(buf)); /* get version of fcrontab file: it permits to daemon not to load - * a file which he won't understand the syntax, for exemple + * a file which he won't understand the syntax, for example * a file using a depreciated format generated by an old fcrontab, * if the syntax has changed */ if ( read_type(fileno(ff), &type, &size) != OK || type != S_HEADER_T || diff --git a/config.h.in b/config.h.in index 198adf3..f3910ad 100644 --- a/config.h.in +++ b/config.h.in @@ -21,7 +21,7 @@ * `LICENSE' that comes with the fcron source distribution. */ - /* $Id: config.h.in,v 1.51 2003-12-29 17:06:16 thib Exp $ */ + /* $Id: config.h.in,v 1.52 2004-01-29 10:34:46 thib Exp $ */ /* *********************************************************** */ @@ -393,7 +393,7 @@ #undef HAVE_LIBSHADOW /* Have SE Linux support */ -#undef CONFIG_FLASK +#undef WITH_SELINUX /* Define if you have the xnet library (-lxnet). */ #undef HAVE_LIBXNET diff --git a/configure.in b/configure.in index 791a01f..650b893 100644 --- a/configure.in +++ b/configure.in @@ -13,7 +13,7 @@ AC_PREFIX_DEFAULT($prefix) AC_CONFIG_HEADER(config.h) AC_PREREQ(2.57) -vers="2.9.4" +vers="2.9.5" vers_quoted="\"$vers\"" AC_DEFINE_UNQUOTED(VERSION, $vers) AC_DEFINE_UNQUOTED(VERSION_QUOTED, $vers_quoted) @@ -44,7 +44,6 @@ AC_CHECK_HEADERS(strings.h) AC_CHECK_HEADERS(sys/types.h sys/socket.h sys/un.h) AC_CHECK_HEADERS(security/pam_appl.h pam/pam_appl.h crypt.h shadow.h) AC_CHECK_HEADERS(sys/resource.h) -AC_CHECK_HEADERS(flask_util.h) dnl Checks for typedefs, structures, and compiler characteristics. AC_C_CONST @@ -61,7 +60,7 @@ AC_TYPE_SIGNAL AC_FUNC_STRFTIME AC_FUNC_WAIT3 AC_CHECK_LIB(xnet, shutdown) -AC_CHECK_LIB(secure, getsecsid, [flaskavail=1], [flaskavail=0]) +AC_CHECK_LIB(selinux, getcon, [selinuxavail=1], [selinuxavail=0]) AC_CHECK_FUNC(getloadavg, [getloadavg=1], [getloadavg=0]) AC_CHECK_LIB(kstat, kstat_open, [kstat=1], [kstat=0]) if test $getloadavg -eq 1; then @@ -925,7 +924,7 @@ AC_ARG_WITH(selinux, AC_MSG_RESULT(no) ;; yes) - if test "$flaskavail" -eq 1; then + if test "$selinuxavail" -eq 1; then useselinux=1 AC_MSG_RESULT(yes) else @@ -940,7 +939,7 @@ AC_ARG_WITH(selinux, AC_MSG_ERROR(Must be set to either "yes" or "no".) ;; esac ], - if test "$useselinux" != "0" && test "$flaskavail" -eq 1; then + if test "$useselinux" != "0" && test "$selinuxavail" -eq 1; then useselinux=1 AC_MSG_RESULT(yes) else @@ -949,8 +948,9 @@ AC_ARG_WITH(selinux, fi ) if test "$useselinux" -eq 1; then - LIBS="$LIBS -lsecure" - AC_DEFINE(CONFIG_FLASK) + LIBS="$LIBS -lselinux" + AC_DEFINE(WITH_SELINUX) + CFLAGS="$CFLAGS -I/usr/include/selinux" fi @@ -1123,9 +1123,9 @@ fi echo "fcron's user (resp. group) name : $username (resp. $groupname)" -echo -n "systab : " +echo -n "sysfcrontab : " if test "$use_sysfcrontab" -eq 1; then - echo "yes" + echo "yes ($sysfcrontab)" else echo "no" fi @@ -1149,4 +1149,4 @@ fi echo echo "You can now run 'make' to compile" echo "and then (as root) 'make install' to install fcron." -echo \ No newline at end of file +echo diff --git a/global.h b/global.h index b3c3213..74b707c 100644 --- a/global.h +++ b/global.h @@ -21,7 +21,7 @@ * `LICENSE' that comes with the fcron source distribution. */ - /* $Id: global.h,v 1.41 2003-12-25 22:43:53 thib Exp $ */ + /* $Id: global.h,v 1.42 2004-01-29 10:30:12 thib Exp $ */ /* @@ -43,12 +43,11 @@ #include #endif -#ifdef CONFIG_FLASK -#include -#include -#include -#include -#include +#ifdef WITH_SELINUX +#include +#include +#include +#include #endif #ifdef HAVE_GETOPT_H @@ -167,9 +166,9 @@ typedef struct cf_t { struct env_t *cf_env_base; /* list of all env variables to set */ int cf_running; /* number of jobs running */ signed char cf_tzdiff; /* time diff between system and local hour */ -#ifdef CONFIG_FLASK - security_id_t cf_user_sid; - security_id_t cf_file_sid; +#ifdef WITH_SELINUX + security_context_t cf_user_context; + security_context_t cf_file_context; #endif } cf_t; diff --git a/save.c b/save.c index dd67b40..272a449 100644 --- a/save.c +++ b/save.c @@ -22,7 +22,7 @@ * `LICENSE' that comes with the fcron source distribution. */ - /* $Id: save.c,v 1.7 2003-12-25 22:52:03 thib Exp $ */ + /* $Id: save.c,v 1.8 2004-01-29 10:34:55 thib Exp $ */ #include "global.h" #include "save.h" @@ -298,12 +298,18 @@ save_one_file(cf_t *file, char *filename, uid_t own_uid, gid_t own_gid, time_t s int fd; /* open file */ -#ifdef CONFIG_FLASK - if ( is_flask_enabled() ) - fd = open_secure(filename, O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, S_IRUSR | S_IWUSR, file->cf_file_sid); - else +#ifdef WITH_SELINUX + if ( is_selinux_enabled() && setfscreatecon(file->cf_file_context) ) + { + error_e("Could not set create context for file %s", filename); + return ERR; + } #endif fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, S_IRUSR|S_IWUSR); +#ifdef WITH_SELINUX + if ( is_selinux_enabled() ) + setfscreatecon(NULL); +#endif if ( fd == -1 ) { error_e("Could not open %s", filename); return ERR;