|
 |
923a60 |
From e3f34eb2e0edc9cefe92e58e2ad4c98bcccf2090 Mon Sep 17 00:00:00 2001
|
|
|
923a60 |
From: Lukas Nykryn <lnykryn@redhat.com>
|
|
|
923a60 |
Date: Thu, 27 Aug 2015 10:33:15 +0200
|
|
|
923a60 |
Subject: [PATCH] selinux: fix check for transient units
|
|
|
923a60 |
|
|
|
923a60 |
SELinux does not have a path to check for a snapshot service creation.
|
|
|
923a60 |
This ends up giving us a bogus check.
|
|
|
923a60 |
|
|
|
923a60 |
On snapshot creation we should check if the remote process type, has the
|
|
|
923a60 |
ability to start a service with the type that systemd is running with.
|
|
|
923a60 |
|
|
|
923a60 |
Based on patch from Vaclav Pavlin and Dan Walsh
|
|
|
923a60 |
http://lists.freedesktop.org/archives/systemd-devel/2013-November/014021.html
|
|
|
923a60 |
|
|
|
923a60 |
RHEL only
|
|
|
923a60 |
Resolves: #1255129
|
|
|
923a60 |
---
|
|
|
923a60 |
src/core/dbus-manager.c | 4 ++--
|
|
|
923a60 |
src/core/selinux-access.c | 11 ++++++-----
|
|
|
923a60 |
src/core/selinux-access.h | 9 ++++++---
|
|
|
923a60 |
3 files changed, 14 insertions(+), 10 deletions(-)
|
|
|
923a60 |
|
|
|
923a60 |
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
|
|
|
923a60 |
index 2bc37ba60e..1ec350e034 100644
|
|
|
923a60 |
--- a/src/core/dbus-manager.c
|
|
|
923a60 |
+++ b/src/core/dbus-manager.c
|
|
|
923a60 |
@@ -734,7 +734,7 @@ static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, voi
|
|
|
923a60 |
if (mode < 0)
|
|
|
923a60 |
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode);
|
|
|
923a60 |
|
|
|
923a60 |
- r = mac_selinux_access_check(message, "start", error);
|
|
|
923a60 |
+ r = mac_selinux_runtime_unit_access_check(message, "start", error);
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
return r;
|
|
|
923a60 |
|
|
|
923a60 |
@@ -1092,7 +1092,7 @@ static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *us
|
|
|
923a60 |
assert(message);
|
|
|
923a60 |
assert(m);
|
|
|
923a60 |
|
|
|
923a60 |
- r = mac_selinux_access_check(message, "start", error);
|
|
|
923a60 |
+ r = mac_selinux_runtime_unit_access_check(message, "start", error);
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
return r;
|
|
|
923a60 |
|
|
|
923a60 |
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
|
|
|
923a60 |
index ce4f394596..91460b8af9 100644
|
|
|
923a60 |
--- a/src/core/selinux-access.c
|
|
|
923a60 |
+++ b/src/core/selinux-access.c
|
|
|
923a60 |
@@ -175,6 +175,7 @@ void mac_selinux_access_free(void) {
|
|
|
923a60 |
*/
|
|
|
923a60 |
int mac_selinux_generic_access_check(
|
|
|
923a60 |
sd_bus_message *message,
|
|
|
923a60 |
+ bool system,
|
|
|
923a60 |
const char *path,
|
|
|
923a60 |
const char *permission,
|
|
|
923a60 |
sd_bus_error *error) {
|
|
|
923a60 |
@@ -213,7 +214,9 @@ int mac_selinux_generic_access_check(
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
goto finish;
|
|
|
923a60 |
|
|
|
923a60 |
- if (path) {
|
|
|
923a60 |
+ tclass = "service";
|
|
|
923a60 |
+
|
|
|
923a60 |
+ if (path && !system) {
|
|
|
923a60 |
/* Get the file context of the unit file */
|
|
|
923a60 |
|
|
|
923a60 |
r = getfilecon(path, &fcon);
|
|
|
923a60 |
@@ -221,16 +224,14 @@ int mac_selinux_generic_access_check(
|
|
|
923a60 |
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
|
|
|
923a60 |
goto finish;
|
|
|
923a60 |
}
|
|
|
923a60 |
-
|
|
|
923a60 |
- tclass = "service";
|
|
|
923a60 |
} else {
|
|
|
923a60 |
r = getcon(&fcon);
|
|
|
923a60 |
if (r < 0) {
|
|
|
923a60 |
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
|
|
|
923a60 |
goto finish;
|
|
|
923a60 |
}
|
|
|
923a60 |
-
|
|
|
923a60 |
- tclass = "system";
|
|
|
923a60 |
+ if (system)
|
|
|
923a60 |
+ tclass = "system";
|
|
|
923a60 |
}
|
|
|
923a60 |
|
|
|
923a60 |
sd_bus_creds_get_cmdline(creds, &cmdline);
|
|
|
923a60 |
diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
|
|
|
923a60 |
index dd1e8bb9d0..7dc271b35d 100644
|
|
|
923a60 |
--- a/src/core/selinux-access.h
|
|
|
923a60 |
+++ b/src/core/selinux-access.h
|
|
|
923a60 |
@@ -28,21 +28,24 @@
|
|
|
923a60 |
|
|
|
923a60 |
void mac_selinux_access_free(void);
|
|
|
923a60 |
|
|
|
923a60 |
-int mac_selinux_generic_access_check(sd_bus_message *message, const char *path, const char *permission, sd_bus_error *error);
|
|
|
923a60 |
+int mac_selinux_generic_access_check(sd_bus_message *message, bool system, const char *path, const char *permission, sd_bus_error *error);
|
|
|
923a60 |
|
|
|
923a60 |
int mac_selinux_unit_access_check_strv(char **units, sd_bus_message *message, Manager *m, const char *permission, sd_bus_error *error);
|
|
|
923a60 |
|
|
|
923a60 |
#ifdef HAVE_SELINUX
|
|
|
923a60 |
|
|
|
923a60 |
#define mac_selinux_access_check(message, permission, error) \
|
|
|
923a60 |
- mac_selinux_generic_access_check((message), NULL, (permission), (error))
|
|
|
923a60 |
+ mac_selinux_generic_access_check((message), true, NULL, (permission), (error))
|
|
|
923a60 |
|
|
|
923a60 |
#define mac_selinux_unit_access_check(unit, message, permission, error) \
|
|
|
923a60 |
({ \
|
|
|
923a60 |
Unit *_unit = (unit); \
|
|
|
923a60 |
- mac_selinux_generic_access_check((message), _unit->source_path ?: _unit->fragment_path, (permission), (error)); \
|
|
|
923a60 |
+ mac_selinux_generic_access_check((message), false, _unit->source_path ?: _unit->fragment_path, (permission), (error)); \
|
|
|
923a60 |
})
|
|
|
923a60 |
|
|
|
923a60 |
+#define mac_selinux_runtime_unit_access_check(message, permission, error) \
|
|
|
923a60 |
+ mac_selinux_generic_access_check((message), false, NULL, (permission), (error))
|
|
|
923a60 |
+
|
|
|
923a60 |
#else
|
|
|
923a60 |
|
|
|
923a60 |
#define mac_selinux_access_check(message, permission, error) 0
|