[redhat-lspp] Xinetd patches for selinux context configuration

[James Antill]

On Wed, 2006-11-29 at 16:22 -0500, Stephen Smalley wrote:
> > +   exepath = SC_SERVER_ARGV( scp )[0];
> > +   if (lgetfilecon(exepath, &exec_context) < 0)
> > +     goto fail_lgetfilecon;
> 
> You want getfilecon() here rather than lgetfilecon(), since you want the
> context of the executable that will be executed by execve, not any
> symlink to it.

 Right.

> > +   if (!context_range_get(pcon))
> > +     goto fail_context_range_get;
> > +   
> > +   if (!context_range_set(bcon, context_range_get(pcon)))
> > +     goto fail_context_range_set;
> 
> context_range_set returns nonzero upon failure - looks like the man page
> is wrong for the _set functions.

 Fixed. I removed the config. stuff for this version, so this should be
ready to include.

diff -rup xinetd-2.3.14-orig/xinetd/child.c xinetd-2.3.14/xinetd/child.c
--- xinetd-2.3.14-orig/xinetd/child.c	2006-11-28 14:03:07.000000000
-0500
+++ xinetd-2.3.14/xinetd/child.c	2006-11-29 17:04:19.000000000 -0500
@@ -33,6 +33,8 @@
 #endif
 #ifdef LABELED_NET
 #include <selinux/selinux.h>
+#include <selinux/flask.h>
+#include <selinux/context.h>
 #endif
 
 #include "str.h"
@@ -49,7 +51,7 @@
 
 /* Local declarations */
 #ifdef LABELED_NET
-static int set_context_from_socket( int fd );
+static int set_context_from_socket( const struct service_config *scp,
int fd );
 #endif
 
 
@@ -158,7 +160,7 @@ void exec_server( const struct server *s
 #ifdef LABELED_NET
    if (SC_LABELED_NET(scp))
    {
-      if (set_context_from_socket( descriptor ) < 0) {
+      if (set_context_from_socket( scp, descriptor ) < 0) {
          msg( LOG_ERR, func,
              "Changing process context failed for %s", SC_ID( scp )) ;
          _exit( 1 ) ;
@@ -485,16 +487,11 @@ void child_exit(void)
 }
 
 #ifdef LABELED_NET
-static int set_context_from_socket( int fd )
+static int set_context( security_context_t cntx )
 {
-   const char *func = "set_context_from_socket" ;
-   security_context_t peer_context;
+   const char *func = "set_context" ;
 
-   if (getpeercon(fd, &peer_context) < 0)
-      return -1;
-
-   int retval = setexeccon(peer_context);
-   freecon( peer_context );
+   int retval = setexeccon(cntx);
 
    if (debug.on)
    {
@@ -513,4 +510,59 @@ static int set_context_from_socket( int 
 
    return retval;
 }
+
+static int set_context_from_socket( const struct service_config *scp,
int fd )
+{
+   security_context_t curr_context = NULL;
+   security_context_t peer_context = NULL;
+   security_context_t exec_context = NULL;
+   context_t bcon = NULL;
+   context_t pcon = NULL;
+   security_context_t new_context = NULL;
+   security_context_t new_exec_context = NULL;
+   int retval = -1;
+   const char *exepath = NULL;
+
+   if (getcon(&curr_context) < 0)
+     goto fail;
+   
+   if (getpeercon(fd, &peer_context) < 0)
+     goto fail;
+
+   exepath = SC_SERVER_ARGV( scp )[0];
+   if (getfilecon(exepath, &exec_context) < 0)
+     goto fail;
+
+   if (!(bcon = context_new(curr_context)))
+     goto fail;
+
+   if (!(pcon = context_new(peer_context)))
+     goto fail;
+
+   if (!context_range_get(pcon))
+     goto fail;
+   
+   if (context_range_set(bcon, context_range_get(pcon)))
+     goto fail;
+
+   if (!(new_context = context_str(bcon)))
+     goto fail;
+   
+   if (security_compute_create(new_context, exec_context,
SECCLASS_PROCESS,
+                               &new_exec_context) < 0)
+     goto fail;
+
+   retval = set_context(new_exec_context);
+
+   freecon(new_exec_context);
+
+ fail:
+   context_free(pcon);
+   context_free(bcon);
+   freecon(exec_context);   
+   freecon(peer_context);
+   freecon(curr_context);
+
+   return retval;
+}
 #endif


-- 
James Antill <jantill at redhat.com>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/redhat-lspp/attachments/20061129/7df8e226/attachment.sig>