663193 rewritten selinux support
This commit is contained in:
Marcela Mašláňová
parent
e987620d6a
commit
bc6c9488f5
210
cronie-1.4.6-selinux.patch
Normal file
210
cronie-1.4.6-selinux.patch
Normal file
@ -0,0 +1,210 @@
|
|||||||
|
diff -up cronie-1.4.6/src/cron.c.old cronie-1.4.6/src/cron.c
|
||||||
|
--- cronie-1.4.6/src/cron.c.old 2010-10-21 07:56:27.000000000 +0200
|
||||||
|
+++ cronie-1.4.6/src/cron.c 2010-12-16 13:44:44.000000000 +0100
|
||||||
|
@@ -198,6 +198,11 @@ int main(int argc, char *argv[]) {
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (cron_init_security() < 0) {
|
||||||
|
+ log_it("CRON", pid, "DEATH", "Critical security parameters not initialized", 0);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* Get the default locale character set for the mail
|
||||||
|
* "Content-Type: ...; charset=" header
|
||||||
|
*/
|
||||||
|
diff -up cronie-1.4.6/src/funcs.h.old cronie-1.4.6/src/funcs.h
|
||||||
|
--- cronie-1.4.6/src/funcs.h.old 2010-10-04 16:07:25.000000000 +0200
|
||||||
|
+++ cronie-1.4.6/src/funcs.h 2010-12-16 09:59:02.000000000 +0100
|
||||||
|
@@ -85,6 +85,8 @@ long get_gmtoff(time_t *, struct tm *);
|
||||||
|
|
||||||
|
/* Red Hat security stuff (security.c):
|
||||||
|
*/
|
||||||
|
+int cron_init_security( void );
|
||||||
|
+
|
||||||
|
void cron_restore_default_security_context( void );
|
||||||
|
|
||||||
|
int cron_set_job_security_context( entry *e, user *u, char ***jobenvp );
|
||||||
|
diff -up cronie-1.4.6/src/security.c.old cronie-1.4.6/src/security.c
|
||||||
|
--- cronie-1.4.6/src/security.c.old 2010-10-04 16:07:25.000000000 +0200
|
||||||
|
+++ cronie-1.4.6/src/security.c 2010-12-16 09:59:02.000000000 +0100
|
||||||
|
@@ -41,15 +41,14 @@ static int
|
||||||
|
cron_conv(int num_msg, const struct pam_message **msgm,
|
||||||
|
struct pam_response **response, void *appdata_ptr)
|
||||||
|
{
|
||||||
|
- struct pam_message**m = msgm;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
for (i = 0; i < num_msg; i++) {
|
||||||
|
- switch (m[i]->msg_style) {
|
||||||
|
+ switch (msgm[i]->msg_style) {
|
||||||
|
case PAM_ERROR_MSG:
|
||||||
|
case PAM_TEXT_INFO:
|
||||||
|
- if (m[i]->msg != NULL) {
|
||||||
|
- log_it("CRON", getpid(), "pam_message", m[i]->msg, 0);
|
||||||
|
+ if (msgm[i]->msg != NULL) {
|
||||||
|
+ log_it("CRON", getpid(), "pam_message", msgm[i]->msg, 0);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
@@ -81,6 +80,11 @@ static char **build_env(char **cronenv);
|
||||||
|
static int cron_change_selinux_range(user * u, security_context_t ucontext);
|
||||||
|
static int cron_get_job_range(user * u, security_context_t * ucontextp,
|
||||||
|
char **jobenv);
|
||||||
|
+
|
||||||
|
+static security_class_t file_class;
|
||||||
|
+static security_class_t context_class;
|
||||||
|
+static access_vector_t entrypoint_bit;
|
||||||
|
+static access_vector_t contains_bit;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
void cron_restore_default_security_context() {
|
||||||
|
@@ -89,6 +93,40 @@ void cron_restore_default_security_conte
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
+int cron_init_security() {
|
||||||
|
+#ifdef WITH_SELINUX
|
||||||
|
+ int rv = -1;
|
||||||
|
+
|
||||||
|
+ if (is_selinux_enabled() <= 0)
|
||||||
|
+ return 0;
|
||||||
|
+
|
||||||
|
+ if (security_getenforce() <= 0)
|
||||||
|
+ rv = 0;
|
||||||
|
+
|
||||||
|
+ file_class = string_to_security_class("file");
|
||||||
|
+ if (!file_class) {
|
||||||
|
+ log_it("CRON", getpid(), "ERROR", "Failed to translate security class file", errno);
|
||||||
|
+ return rv;
|
||||||
|
+ }
|
||||||
|
+ context_class = string_to_security_class("context");
|
||||||
|
+ if (!context_class) {
|
||||||
|
+ log_it("CRON", getpid(), "ERROR", "Failed to translate security class context", errno);
|
||||||
|
+ return rv;
|
||||||
|
+ }
|
||||||
|
+ entrypoint_bit = string_to_av_perm(file_class, "entrypoint");
|
||||||
|
+ if (!entrypoint_bit) {
|
||||||
|
+ log_it("CRON", getpid(), "ERROR", "Failed to translate av perm entrypoint", errno);
|
||||||
|
+ return rv;
|
||||||
|
+ }
|
||||||
|
+ contains_bit = string_to_av_perm(context_class, "contains");
|
||||||
|
+ if (!contains_bit) {
|
||||||
|
+ log_it("CRON", getpid(), "ERROR", "Failed to translate av perm contains", errno);
|
||||||
|
+ return rv;
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
int cron_set_job_security_context(entry * e, user * u, char ***jobenv) {
|
||||||
|
time_t minutely_time = 0;
|
||||||
|
#ifdef WITH_PAM
|
||||||
|
@@ -254,7 +292,7 @@ static int cron_authorize_context(securi
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
struct av_decision avd;
|
||||||
|
int retval;
|
||||||
|
- unsigned int bit = FILE__ENTRYPOINT;
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Since crontab files are not directly executed,
|
||||||
|
* crond must ensure that the crontab file has
|
||||||
|
@@ -262,9 +300,11 @@ static int cron_authorize_context(securi
|
||||||
|
* the user cron job. It performs an entrypoint
|
||||||
|
* permission check for this purpose.
|
||||||
|
*/
|
||||||
|
+ if (!file_class || !entrypoint_bit)
|
||||||
|
+ return 0;
|
||||||
|
retval = security_compute_av(scontext, file_context,
|
||||||
|
- SECCLASS_FILE, bit, &avd);
|
||||||
|
- if (retval || ((bit & avd.allowed) != bit))
|
||||||
|
+ file_class, entrypoint_bit, &avd);
|
||||||
|
+ if (retval || ((entrypoint_bit & avd.allowed) != entrypoint_bit))
|
||||||
|
return 0;
|
||||||
|
#endif
|
||||||
|
return 1;
|
||||||
|
@@ -275,16 +315,17 @@ static int cron_authorize_range(security
|
||||||
|
#ifdef WITH_SELINUX
|
||||||
|
struct av_decision avd;
|
||||||
|
int retval;
|
||||||
|
- unsigned int bit = CONTEXT__CONTAINS;
|
||||||
|
/*
|
||||||
|
* Since crontab files are not directly executed,
|
||||||
|
* so crond must ensure that any user specified range
|
||||||
|
* falls within the seusers-specified range for that Linux user.
|
||||||
|
*/
|
||||||
|
+ if (!context_class || !contains_bit)
|
||||||
|
+ return 0;
|
||||||
|
retval = security_compute_av(scontext, ucontext,
|
||||||
|
- SECCLASS_CONTEXT, bit, &avd);
|
||||||
|
+ context_class, contains_bit, &avd);
|
||||||
|
|
||||||
|
- if (retval || ((bit & avd.allowed) != bit))
|
||||||
|
+ if (retval || ((contains_bit & avd.allowed) != contains_bit))
|
||||||
|
return 0;
|
||||||
|
#endif
|
||||||
|
return 1;
|
||||||
|
@@ -479,15 +520,22 @@ get_security_context(const char *name, i
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!cron_authorize_context(scontext, file_context)) {
|
||||||
|
+ char *msg=NULL;
|
||||||
|
+ if (asprintf(&msg,
|
||||||
|
+ "Unauthorized SELinux context=%s file_context=%s", (char *) scontext, file_context) >= 0) {
|
||||||
|
+ log_it(name, getpid(), msg, tabname, 0);
|
||||||
|
+ free(msg);
|
||||||
|
+ } else {
|
||||||
|
+ log_it(name, getpid(), "Unauthorized SELinux context", tabname, 0);
|
||||||
|
+ }
|
||||||
|
freecon(scontext);
|
||||||
|
freecon(file_context);
|
||||||
|
if (security_getenforce() > 0) {
|
||||||
|
- log_it(name, getpid(), "Unauthorized SELinux context", tabname, 0);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
log_it(name, getpid(),
|
||||||
|
- "Unauthorized SELinux context, but SELinux in permissive mode, continuing",
|
||||||
|
+ "SELinux in permissive mode, continuing",
|
||||||
|
tabname, 0);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
@@ -515,22 +563,30 @@ int crontab_security_access(void) {
|
||||||
|
security_context_t user_context;
|
||||||
|
if (getprevcon_raw(&user_context) == 0) {
|
||||||
|
security_class_t passwd_class;
|
||||||
|
+ access_vector_t crontab_bit;
|
||||||
|
struct av_decision avd;
|
||||||
|
- int retval;
|
||||||
|
+ int retval = 0;
|
||||||
|
|
||||||
|
passwd_class = string_to_security_class("passwd");
|
||||||
|
if (passwd_class == 0) {
|
||||||
|
- selinux_check_passwd_access = -1;
|
||||||
|
fprintf(stderr, "Security class \"passwd\" is not defined in the SELinux policy.\n");
|
||||||
|
+ retval = -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (retval == 0) {
|
||||||
|
+ crontab_bit = string_to_av_perm(passwd_class, "crontab");
|
||||||
|
+ if (crontab_bit == 0) {
|
||||||
|
+ fprintf(stderr, "Security av permission \"crontab\" is not defined in the SELinux policy.\n");
|
||||||
|
+ retval = -1;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
- retval = security_compute_av_raw(user_context,
|
||||||
|
- user_context,
|
||||||
|
- passwd_class,
|
||||||
|
- PASSWD__CRONTAB,
|
||||||
|
- &avd);
|
||||||
|
+ if (retval == 0)
|
||||||
|
+ retval = security_compute_av_raw(user_context,
|
||||||
|
+ user_context, passwd_class,
|
||||||
|
+ crontab_bit, &avd);
|
||||||
|
|
||||||
|
- if ((retval == 0) && ((PASSWD__CRONTAB & avd.allowed) == PASSWD__CRONTAB)) {
|
||||||
|
+ if ((retval == 0) && ((crontab_bit & avd.allowed) == crontab_bit)) {
|
||||||
|
selinux_check_passwd_access = 0;
|
||||||
|
}
|
||||||
|
freecon(user_context);
|
||||||
10
cronie.spec
10
cronie.spec
@ -6,7 +6,7 @@
|
|||||||
Summary: Cron daemon for executing programs at set times
|
Summary: Cron daemon for executing programs at set times
|
||||||
Name: cronie
|
Name: cronie
|
||||||
Version: 1.4.6
|
Version: 1.4.6
|
||||||
Release: 5%{?dist}
|
Release: 7%{?dist}
|
||||||
License: MIT and BSD and ISC and GPLv2
|
License: MIT and BSD and ISC and GPLv2
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
URL: https://fedorahosted.org/cronie
|
URL: https://fedorahosted.org/cronie
|
||||||
@ -14,6 +14,7 @@ Source0: https://fedorahosted.org/releases/c/r/cronie/%{name}-%{version}.tar.gz
|
|||||||
Source1: cronie.systemd
|
Source1: cronie.systemd
|
||||||
Patch0: cronie-1.4.6-manpages.patch
|
Patch0: cronie-1.4.6-manpages.patch
|
||||||
Patch1: cronie-1.4.6-anacron-locks.patch
|
Patch1: cronie-1.4.6-anacron-locks.patch
|
||||||
|
Patch2: cronie-1.4.6-selinux.patch
|
||||||
|
|
||||||
Requires: syslog, bash >= 2.0
|
Requires: syslog, bash >= 2.0
|
||||||
Conflicts: sysklogd < 1.4.1
|
Conflicts: sysklogd < 1.4.1
|
||||||
@ -79,6 +80,7 @@ Old style of {hourly,daily,weekly,monthly}.jobs without anacron. No features.
|
|||||||
%setup -q
|
%setup -q
|
||||||
%patch0 -p1
|
%patch0 -p1
|
||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
|
%patch2 -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
|
|
||||||
@ -210,6 +212,12 @@ cp -a /var/lock/subsys/crond /var/lock/subsys/cronie > /dev/null 2>&1 ||:
|
|||||||
%attr(0644,root,root) %{_sysconfdir}/cron.d/dailyjobs
|
%attr(0644,root,root) %{_sysconfdir}/cron.d/dailyjobs
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Dec 16 2010 Marcela Mašláňová <mmaslano@redhat.com> - 1.4.6-7
|
||||||
|
- 663193 rewritten selinux support
|
||||||
|
|
||||||
|
* Wed Dec 15 2010 Marcela Mašláňová <mmaslano@redhat.com> - 1.4.6-6
|
||||||
|
- apply selinux patch from dwalsh
|
||||||
|
|
||||||
* Fri Dec 10 2010 Tomas Mraz <tmraz@redhat.com> - 1.4.6-5
|
* Fri Dec 10 2010 Tomas Mraz <tmraz@redhat.com> - 1.4.6-5
|
||||||
- do not lock jobs that fall out of allowed range - 661966
|
- do not lock jobs that fall out of allowed range - 661966
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user