|
 |
f8b01f |
From a82e1be24d0211d4358d8ff3b8cd06dae71a9993 Mon Sep 17 00:00:00 2001
|
|
|
f8b01f |
From: David King <dking@redhat.com>
|
|
|
f8b01f |
Date: Mon, 22 Aug 2016 09:43:29 +0100
|
|
|
f8b01f |
Subject: [PATCH] Use _raw() calls to avoid SELinux context translation
|
|
|
f8b01f |
|
|
|
f8b01f |
When the credentials obtained from the client socket are used in future
|
|
|
f8b01f |
security checks, no context translation should be performed, so
|
|
|
f8b01f |
getpeercon() should be replaced with getpeercon_raw(), and similar
|
|
|
f8b01f |
changes should me be made for other calls such as avc_sid_to_context()
|
|
|
f8b01f |
and getcon().
|
|
|
f8b01f |
|
|
|
f8b01f |
https://bugzilla.redhat.com/show_bug.cgi?id=1356141
|
|
|
f8b01f |
---
|
|
|
f8b01f |
bus/selinux.c | 10 +++++-----
|
|
|
f8b01f |
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
f8b01f |
|
|
|
f8b01f |
diff --git a/bus/selinux.c b/bus/selinux.c
|
|
|
f8b01f |
index 2fb4a8b..13361aa 100644
|
|
|
f8b01f |
--- a/bus/selinux.c
|
|
|
f8b01f |
+++ b/bus/selinux.c
|
|
|
f8b01f |
@@ -412,14 +412,14 @@ bus_selinux_full_init (void)
|
|
|
f8b01f |
bus_context = NULL;
|
|
|
f8b01f |
bus_sid = SECSID_WILD;
|
|
|
f8b01f |
|
|
|
f8b01f |
- if (getcon (&bus_context) < 0)
|
|
|
f8b01f |
+ if (getcon_raw (&bus_context) < 0)
|
|
|
f8b01f |
{
|
|
|
f8b01f |
_dbus_verbose ("Error getting context of bus: %s\n",
|
|
|
f8b01f |
_dbus_strerror (errno));
|
|
|
f8b01f |
return FALSE;
|
|
|
f8b01f |
}
|
|
|
f8b01f |
|
|
|
f8b01f |
- if (avc_context_to_sid (bus_context, &bus_sid) < 0)
|
|
|
f8b01f |
+ if (avc_context_to_sid_raw (bus_context, &bus_sid) < 0)
|
|
|
f8b01f |
{
|
|
|
f8b01f |
_dbus_verbose ("Error getting SID from bus context: %s\n",
|
|
|
f8b01f |
_dbus_strerror (errno));
|
|
|
f8b01f |
@@ -713,7 +713,7 @@ bus_selinux_append_context (DBusMessage *message,
|
|
|
f8b01f |
#ifdef HAVE_SELINUX
|
|
|
f8b01f |
char *context;
|
|
|
f8b01f |
|
|
|
f8b01f |
- if (avc_sid_to_context (SELINUX_SID_FROM_BUS (sid), &context) < 0)
|
|
|
f8b01f |
+ if (avc_sid_to_context_raw (SELINUX_SID_FROM_BUS (sid), &context) < 0)
|
|
|
f8b01f |
{
|
|
|
f8b01f |
if (errno == ENOMEM)
|
|
|
f8b01f |
BUS_SET_OOM (error);
|
|
|
f8b01f |
@@ -766,7 +766,7 @@ bus_connection_read_selinux_context (DBusConnection *connection,
|
|
|
f8b01f |
return FALSE;
|
|
|
f8b01f |
}
|
|
|
f8b01f |
|
|
|
f8b01f |
- if (getpeercon (fd, con) < 0)
|
|
|
f8b01f |
+ if (getpeercon_raw (fd, con) < 0)
|
|
|
f8b01f |
{
|
|
|
f8b01f |
_dbus_verbose ("Error getting context of socket peer: %s\n",
|
|
|
f8b01f |
_dbus_strerror (errno));
|
|
|
f8b01f |
@@ -901,7 +901,7 @@ bus_selinux_init_connection_id (DBusConnection *connection,
|
|
|
f8b01f |
|
|
|
f8b01f |
_dbus_verbose ("Converting context to SID to store on connection\n");
|
|
|
f8b01f |
|
|
|
f8b01f |
- if (avc_context_to_sid (con, &sid) < 0)
|
|
|
f8b01f |
+ if (avc_context_to_sid_raw (con, &sid) < 0)
|
|
|
f8b01f |
{
|
|
|
f8b01f |
if (errno == ENOMEM)
|
|
|
f8b01f |
BUS_SET_OOM (error);
|
|
|
f8b01f |
--
|
|
|
f8b01f |
2.7.4
|
|
|
f8b01f |
|