|
 |
905b4d |
From a77f0b5c39b1f6c497b2b5c6c072d2f4f6e7a745 Mon Sep 17 00:00:00 2001
|
|
|
905b4d |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
905b4d |
Date: Mon, 26 Jan 2015 15:15:29 +0100
|
|
|
905b4d |
Subject: [PATCH 182/183] SELINUX: Call setuid(0)/setgid(0) to also set the
|
|
|
905b4d |
real IDs to root
|
|
|
905b4d |
MIME-Version: 1.0
|
|
|
905b4d |
Content-Type: text/plain; charset=UTF-8
|
|
|
905b4d |
Content-Transfer-Encoding: 8bit
|
|
|
905b4d |
|
|
|
905b4d |
https://fedorahosted.org/sssd/ticket/2564
|
|
|
905b4d |
|
|
|
905b4d |
libselinux uses many access(2) calls and access() uses the real UID,
|
|
|
905b4d |
not the effective UID for the check. Therefore, the setuid selinux_child,
|
|
|
905b4d |
which only has effective UID of root would fail the check.
|
|
|
905b4d |
|
|
|
905b4d |
Reviewed-by: Michal Židek <mzidek@redhat.com>
|
|
|
905b4d |
(cherry picked from commit 486f0d5227a9b81815aaaf7d9a2c39aafcbfdf6a)
|
|
|
905b4d |
---
|
|
|
905b4d |
src/providers/ipa/selinux_child.c | 18 +++++++++++++++++-
|
|
|
905b4d |
1 file changed, 17 insertions(+), 1 deletion(-)
|
|
|
905b4d |
|
|
|
905b4d |
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
|
|
|
905b4d |
index a38ffcb26f890349f47478063103e603fe6304cf..bda89c847dc160e1d667d333ee515cf7260e7db8 100644
|
|
|
905b4d |
--- a/src/providers/ipa/selinux_child.c
|
|
|
905b4d |
+++ b/src/providers/ipa/selinux_child.c
|
|
|
905b4d |
@@ -197,7 +197,23 @@ int main(int argc, const char *argv[])
|
|
|
905b4d |
|
|
|
905b4d |
DEBUG(SSSDBG_TRACE_FUNC, "selinux_child started.\n");
|
|
|
905b4d |
DEBUG(SSSDBG_TRACE_INTERNAL,
|
|
|
905b4d |
- "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
|
|
|
905b4d |
+ "Running with effective IDs: [%"SPRIuid"][%"SPRIgid"].\n",
|
|
|
905b4d |
+ geteuid(), getegid());
|
|
|
905b4d |
+
|
|
|
905b4d |
+ /* libsemanage calls access(2) which works with real IDs, not effective.
|
|
|
905b4d |
+ * We need to switch also the real ID to 0.
|
|
|
905b4d |
+ */
|
|
|
905b4d |
+ if (getuid() != 0) {
|
|
|
905b4d |
+ setuid(0);
|
|
|
905b4d |
+ }
|
|
|
905b4d |
+
|
|
|
905b4d |
+ if (getgid() != 0) {
|
|
|
905b4d |
+ setgid(0);
|
|
|
905b4d |
+ }
|
|
|
905b4d |
+
|
|
|
905b4d |
+ DEBUG(SSSDBG_TRACE_INTERNAL,
|
|
|
905b4d |
+ "Running with real IDs [%"SPRIuid"][%"SPRIgid"].\n",
|
|
|
905b4d |
+ getuid(), getgid());
|
|
|
905b4d |
|
|
|
905b4d |
main_ctx = talloc_new(NULL);
|
|
|
905b4d |
if (main_ctx == NULL) {
|
|
|
905b4d |
--
|
|
|
905b4d |
2.1.0
|
|
|
905b4d |
|