79 lines
2.5 KiB
Diff
79 lines
2.5 KiB
Diff
From 29d9996dd200916db888d41196f87609bce329ff Mon Sep 17 00:00:00 2001
|
|
From: Petr Lautrbach <plautrba@redhat.com>
|
|
Date: Apr 07 2020 11:55:38 +0000
|
|
Subject: Do not use deprecated flask.h and av_permissions.h
|
|
|
|
|
|
selinux/flask.h and selinux/av_permissions.h will be completely dropped in the
|
|
next SELinux release.
|
|
|
|
Use string_to_security_class() and string_to_av_perm() to get class and
|
|
permission values. The original hardcoded values could be invalid and are
|
|
deprecated as the whole flask.h and av_permissions.h header files.
|
|
|
|
Fixes: https://pagure.io/libuser/issue/44
|
|
|
|
---
|
|
|
|
diff --git a/apps/apputil.c b/apps/apputil.c
|
|
index 1937645..7413ab5 100644
|
|
--- a/apps/apputil.c
|
|
+++ b/apps/apputil.c
|
|
@@ -26,8 +26,6 @@
|
|
#include <unistd.h>
|
|
#ifdef WITH_SELINUX
|
|
#include <selinux/selinux.h>
|
|
-#include <selinux/av_permissions.h>
|
|
-#include <selinux/flask.h>
|
|
#include <selinux/context.h>
|
|
#endif
|
|
#include "../lib/error.h"
|
|
@@ -57,7 +55,7 @@ check_access(const char *chuser, access_vector_t access)
|
|
|
|
retval = security_compute_av(user_context,
|
|
user_context,
|
|
- SECCLASS_PASSWD,
|
|
+ string_to_security_class("passwd"),
|
|
access, &avd);
|
|
|
|
if (retval == 0 && (avd.allowed & access) == access)
|
|
@@ -221,19 +219,25 @@ lu_authenticate_unprivileged(struct lu_context *ctx, const char *user,
|
|
#ifdef WITH_SELINUX
|
|
if (is_selinux_enabled() > 0) {
|
|
/* FIXME: PASSWD_CHSH, PASSWD_PASSWD ? */
|
|
- if (getuid() == 0 && check_access(user, PASSWD__CHFN) != 0) {
|
|
- security_context_t user_context;
|
|
+ if (getuid() == 0) {
|
|
+ security_class_t class;
|
|
+ access_vector_t perm;
|
|
+ class = string_to_security_class("passwd");
|
|
+ perm = string_to_av_perm(class, "chfn");
|
|
+ if (check_access(user, perm) != 0) {
|
|
+ security_context_t user_context;
|
|
|
|
- if (getprevcon(&user_context) < 0)
|
|
- user_context = NULL;
|
|
- /* FIXME: "change the finger info?" */
|
|
- fprintf(stderr,
|
|
- _("%s is not authorized to change the finger "
|
|
- "info of %s\n"), user_context ? user_context
|
|
- : _("Unknown user context"), user);
|
|
- if (user_context != NULL)
|
|
- freecon(user_context);
|
|
- goto err;
|
|
+ if (getprevcon(&user_context) < 0)
|
|
+ user_context = NULL;
|
|
+ /* FIXME: "change the finger info?" */
|
|
+ fprintf(stderr,
|
|
+ _("%s is not authorized to change the finger "
|
|
+ "info of %s\n"), user_context ? user_context
|
|
+ : _("Unknown user context"), user);
|
|
+ if (user_context != NULL)
|
|
+ freecon(user_context);
|
|
+ goto err;
|
|
+ }
|
|
}
|
|
/* FIXME: is this right for lpasswd? */
|
|
if (!lu_util_fscreate_from_file("/etc/passwd", NULL)) {
|
|
|