On Tue, Jan 27, 2015 at 11:31:58AM +0100, Jakub Hrozek wrote:
On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> Alternatively, we could only set and reset the umask in the caller. That
> way, we would know that a short-lived selinux_child is changing umask.
>
> That is safer, but risks that we forget next time..so at least we need
> to add a comment to the declaration in header.
Attached is an alternate patch that only touches the umask in the
short-lived process.
I would prefer this version if it passes Michal's tests.
bye,
Sumit
From 0d40464b1e9a555700349105c5e87b055e0286d6 Mon Sep 17 00:00:00
2001
From: Jakub Hrozek <jhrozek(a)redhat.com>
Date: Tue, 27 Jan 2015 11:12:18 +0100
Subject: [PATCH] SELINUX: Set and reset umask when caling set_seuser from
deamon code
---
src/providers/ipa/selinux_child.c | 14 +++++++++++++-
src/util/util.h | 4 ++++
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index 6390d43cbe4f3d352702493c156f93ca20b07a2f..ec47ed818efb3ebc93c780a2b0fe6d900e463f2c
100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -135,6 +135,18 @@ static errno_t prepare_response(TALLOC_CTX *mem_ctx,
return EOK;
}
+static int sc_set_seuser(const char *login_name, const char *seuser_name,
+ const char *mls)
+{
+ int ret;
+ mode_t old_mask;
+
+ old_mask = umask(0);
+ ret = set_seuser(login_name, seuser_name, mls);
+ umask(old_mask);
+ return ret;
+}
+
int main(int argc, const char *argv[])
{
int opt;
@@ -256,7 +268,7 @@ int main(int argc, const char *argv[])
DEBUG(SSSDBG_TRACE_FUNC, "performing selinux operations\n");
- ret = set_seuser(ibuf->username, ibuf->seuser, ibuf->mls_range);
+ ret = sc_set_seuser(ibuf->username, ibuf->seuser, ibuf->mls_range);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot set SELinux login context.\n");
goto fail;
diff --git a/src/util/util.h b/src/util/util.h
index 4ee9bad113299d8fb3eabebec508c2ab4c80d4e9..22d6ef0a4e1340346d3d2997313aab50410f9dc0
100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -640,6 +640,10 @@ errno_t switch_creds(TALLOC_CTX *mem_ctx,
errno_t restore_creds(struct sss_creds *saved_creds);
/* from sss_semanage.c */
+/* Please note that libsemange relies on files and directories created with
+ * certain permissions. Therefore the caller should make sure the umask is
+ * not too restricted (especially when called from the daemon code).
+ */
int set_seuser(const char *login_name, const char *seuser_name,
const char *mlsrange);
int del_seuser(const char *login_name);
--
2.1.0
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel