pam_selinux: check unknown object classes or permissions in current policy
This commit is contained in:
ikerexxe
parent
a346ac13e2
commit
055b81078c
96
pam-1.3.1-pam_selinux-check-unknown-objects.patch
Normal file
96
pam-1.3.1-pam_selinux-check-unknown-objects.patch
Normal file
@ -0,0 +1,96 @@
|
|||||||
|
From c6c51832af8e7724cfbd454daa65a6644f5b45c2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ikerexxe <ipedrosa@redhat.com>
|
||||||
|
Date: Fri, 6 Mar 2020 15:04:09 +0100
|
||||||
|
Subject: [PATCH] pam_selinux: check unknown object classes or permissions in
|
||||||
|
current policy
|
||||||
|
|
||||||
|
Explanation: check whether unknown object classes or permissions are allowed or denied in the current policy
|
||||||
|
|
||||||
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1680961
|
||||||
|
---
|
||||||
|
modules/pam_selinux/pam_selinux.c | 50 +++++--------------------------
|
||||||
|
1 file changed, 8 insertions(+), 42 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/modules/pam_selinux/pam_selinux.c b/modules/pam_selinux/pam_selinux.c
|
||||||
|
index 96f9c831..827f5942 100644
|
||||||
|
--- a/modules/pam_selinux/pam_selinux.c
|
||||||
|
+++ b/modules/pam_selinux/pam_selinux.c
|
||||||
|
@@ -157,42 +157,6 @@ query_response (pam_handle_t *pamh, const char *text, const char *def,
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static int mls_range_allowed(pam_handle_t *pamh, security_context_t src, security_context_t dst, int debug)
|
||||||
|
-{
|
||||||
|
- struct av_decision avd;
|
||||||
|
- int retval;
|
||||||
|
- security_class_t class;
|
||||||
|
- access_vector_t bit;
|
||||||
|
- context_t src_context;
|
||||||
|
- context_t dst_context;
|
||||||
|
-
|
||||||
|
- class = string_to_security_class("context");
|
||||||
|
- if (!class) {
|
||||||
|
- pam_syslog(pamh, LOG_ERR, "Failed to translate security class context. %m");
|
||||||
|
- return 0;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- bit = string_to_av_perm(class, "contains");
|
||||||
|
- if (!bit) {
|
||||||
|
- pam_syslog(pamh, LOG_ERR, "Failed to translate av perm contains. %m");
|
||||||
|
- return 0;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- src_context = context_new (src);
|
||||||
|
- dst_context = context_new (dst);
|
||||||
|
- context_range_set(dst_context, context_range_get(src_context));
|
||||||
|
- if (debug)
|
||||||
|
- pam_syslog(pamh, LOG_NOTICE, "Checking if %s mls range valid for %s", dst, context_str(dst_context));
|
||||||
|
-
|
||||||
|
- retval = security_compute_av(context_str(dst_context), dst, class, bit, &avd);
|
||||||
|
- context_free(src_context);
|
||||||
|
- context_free(dst_context);
|
||||||
|
- if (retval || ((bit & avd.allowed) != bit))
|
||||||
|
- return 0;
|
||||||
|
-
|
||||||
|
- return 1;
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
static security_context_t
|
||||||
|
config_context (pam_handle_t *pamh, security_context_t defaultcon, int use_current_range, int debug)
|
||||||
|
{
|
||||||
|
@@ -274,16 +238,17 @@ config_context (pam_handle_t *pamh, security_context_t defaultcon, int use_curre
|
||||||
|
goto fail_set;
|
||||||
|
context_free(new_context);
|
||||||
|
|
||||||
|
- /* we have to check that this user is allowed to go into the
|
||||||
|
- range they have specified ... role is tied to an seuser, so that'll
|
||||||
|
- be checked at setexeccon time */
|
||||||
|
- if (mls_enabled && !mls_range_allowed(pamh, defaultcon, newcon, debug)) {
|
||||||
|
+ /* we have to check that this user is allowed to go into the
|
||||||
|
+ range they have specified ... role is tied to an seuser, so that'll
|
||||||
|
+ be checked at setexeccon time */
|
||||||
|
+ if (mls_enabled &&
|
||||||
|
+ selinux_check_access(defaultcon, newcon, "context", "contains", NULL) != 0) {
|
||||||
|
pam_syslog(pamh, LOG_NOTICE, "Security context %s is not allowed for %s", defaultcon, newcon);
|
||||||
|
|
||||||
|
send_audit_message(pamh, 0, defaultcon, newcon);
|
||||||
|
|
||||||
|
free(newcon);
|
||||||
|
- goto fail_range;
|
||||||
|
+ goto fail_range;
|
||||||
|
}
|
||||||
|
return newcon;
|
||||||
|
}
|
||||||
|
@@ -385,7 +350,8 @@ context_from_env (pam_handle_t *pamh, security_context_t defaultcon, int env_par
|
||||||
|
/* we have to check that this user is allowed to go into the
|
||||||
|
range they have specified ... role is tied to an seuser, so that'll
|
||||||
|
be checked at setexeccon time */
|
||||||
|
- if (mls_enabled && !mls_range_allowed(pamh, defaultcon, newcon, debug)) {
|
||||||
|
+ if (mls_enabled &&
|
||||||
|
+ selinux_check_access(defaultcon, newcon, "context", "contains", NULL) != 0) {
|
||||||
|
pam_syslog(pamh, LOG_NOTICE, "Security context %s is not allowed for %s", defaultcon, newcon);
|
||||||
|
|
||||||
|
goto fail_set;
|
||||||
|
--
|
||||||
|
2.24.1
|
||||||
|
|
||||||
7
pam.spec
7
pam.spec
@ -3,7 +3,7 @@
|
|||||||
Summary: An extensible library which provides authentication for applications
|
Summary: An extensible library which provides authentication for applications
|
||||||
Name: pam
|
Name: pam
|
||||||
Version: 1.3.1
|
Version: 1.3.1
|
||||||
Release: 23%{?dist}
|
Release: 24%{?dist}
|
||||||
# The library is BSD licensed with option to relicense as GPLv2+
|
# The library is BSD licensed with option to relicense as GPLv2+
|
||||||
# - this option is redundant as the BSD license allows that anyway.
|
# - this option is redundant as the BSD license allows that anyway.
|
||||||
# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
|
# pam_timestamp, pam_loginuid, and pam_console modules are GPLv2+.
|
||||||
@ -62,6 +62,7 @@ Patch50: pam-1.3.1-fds-closing.patch
|
|||||||
Patch51: pam-1.3.1-authtok-verify-fix.patch
|
Patch51: pam-1.3.1-authtok-verify-fix.patch
|
||||||
Patch52: pam-1.3.1-add-pam_usertype.patch
|
Patch52: pam-1.3.1-add-pam_usertype.patch
|
||||||
Patch53: pam-1.3.1-add-pam_usertype-fix-backport.patch
|
Patch53: pam-1.3.1-add-pam_usertype-fix-backport.patch
|
||||||
|
Patch54: pam-1.3.1-pam_selinux-check-unknown-objects.patch
|
||||||
|
|
||||||
%global _pamlibdir %{_libdir}
|
%global _pamlibdir %{_libdir}
|
||||||
%global _moduledir %{_libdir}/security
|
%global _moduledir %{_libdir}/security
|
||||||
@ -154,6 +155,7 @@ cp %{SOURCE18} .
|
|||||||
%patch51 -p1 -b .authtok-verify-fix
|
%patch51 -p1 -b .authtok-verify-fix
|
||||||
%patch52 -p1 -b .add-pam_usertype
|
%patch52 -p1 -b .add-pam_usertype
|
||||||
%patch53 -p1 -b .add-pam_usertype-backport
|
%patch53 -p1 -b .add-pam_usertype-backport
|
||||||
|
%patch54 -p1 -b .pam_selinux-check-unknown-objects
|
||||||
|
|
||||||
autoreconf -i
|
autoreconf -i
|
||||||
|
|
||||||
@ -404,6 +406,9 @@ done
|
|||||||
%doc doc/specs/rfc86.0.txt
|
%doc doc/specs/rfc86.0.txt
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Mar 9 2020 Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-24
|
||||||
|
- pam_selinux: check unknown object classes or permissions in current policy
|
||||||
|
|
||||||
* Tue Feb 4 2020 Pavel Březina <pbrezina@redhat.com> - 1.3.1-23
|
* Tue Feb 4 2020 Pavel Březina <pbrezina@redhat.com> - 1.3.1-23
|
||||||
- Add pam_usertype.so
|
- Add pam_usertype.so
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user