--- Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c.range 2007-01-04 23:29:04.000000000 +0100 +++ Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c 2007-01-05 13:30:31.000000000 +0100 @@ -435,6 +435,7 @@ int i, debug = 0, ttys=1, has_tty=isatty(0); int verbose=0, close_session=0; int select_context = 0; + int use_current_range = 0; int ret = 0; security_context_t* contextlist = NULL; int num_contexts = 0; @@ -461,11 +462,19 @@ if (strcmp(argv[i], "select_context") == 0) { select_context = 1; } + if (strcmp(argv[i], "use_current_range") == 0) { + use_current_range = 1; + } } - + if (debug) pam_syslog(pamh, LOG_NOTICE, "Open Session"); + if (select_context && use_current_range) { + pam_syslog(pamh, LOG_ERR, "select_context cannot be used with use_current_range"); + select_context = 0; + } + /* this module is only supposed to execute close_session */ if (close_session) return PAM_SUCCESS; @@ -532,6 +541,51 @@ return PAM_SUCCESS; } } + + if (use_current_range && is_selinux_mls_enabled()) { + security_context_t process_context=NULL; + if (getcon(&process_context) == 0) { + context_t pcon, ucon; + char *process_level=NULL; + security_context_t orig_context; + + if (user_context) + orig_context = user_context; + else + orig_context = default_user_context; + + pcon = context_new(process_context); + freecon(process_context); + process_level = strdup(context_range_get(pcon)); + context_free(pcon); + + if (debug) + pam_syslog (pamh, LOG_DEBUG, "process level=%s", process_level); + + ucon = context_new(orig_context); + + context_range_set(ucon, process_level); + free(process_level); + + if (!mls_range_allowed(pamh, orig_context, context_str(ucon), debug)) { + send_text(pamh, _("Requested MLS level not in permitted range"), debug); + /* even if default_user_context is NULL audit that anyway */ + send_audit_message(pamh, 0, default_user_context, context_str(ucon)); + context_free(ucon); + return PAM_AUTH_ERR; + } + + if (debug) + pam_syslog (pamh, LOG_DEBUG, "adjusted context=%s", context_str(ucon)); + + /* replace the user context with the level adjusted one */ + freecon(user_context); + user_context = strdup(context_str(ucon)); + + context_free(ucon); + } + } + if (getexeccon(&prev_user_context)<0) { prev_user_context=NULL; } --- Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.8.xml.range 2007-01-04 23:29:04.000000000 +0100 +++ Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.8.xml 2007-01-04 23:35:03.000000000 +0100 @@ -36,6 +36,9 @@ select_context + + use_current_range + @@ -132,6 +135,17 @@ + + + + + + + Use the sensitivity range of the process for the user context. + This option and the select_context option are mutually exclusive. + + +