rpms/policycoreutils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add umount code to seunshare to cleanup left over mounts of /var/tmp

Browse Source
This commit is contained in:
Dan Walsh 2011-12-22 18:59:59 +00:00
parent 414b6a904d
commit 6525007747
2 changed files with 65 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
policycoreutils-rhat.patch
View File

@ -63,27 +63,66 @@ index 89f5d97..dfd9629 100644
restore_init(&r_opts);
diff --git a/policycoreutils/run_init/run_init.c b/policycoreutils/run_init/run_init.c
index 9db766c..068e24c 100644
index 9db766c..92034be 100644
--- a/policycoreutils/run_init/run_init.c
+++ b/policycoreutils/run_init/run_init.c
@@ -414,10 +414,17 @@ int main(int argc, char *argv[])
* execvp or using a exec(1) recycles pty's, and does not open a new
* one.
*/
+#ifdef USE_OPEN_INIT_PTY
if (execvp("/usr/sbin/open_init_pty", argv)) {
perror("execvp");
@@ -406,6 +406,13 @@ int main(int argc, char *argv[])
new_context);
exit(-1);
}
+#else
+ if (! access("/usr/sbin/open_init_pty", X_OK)) {
+ if (execvp(argv[1], argv + 1)) {
+ perror("execvp");
+ exit(-1);
+ }
+#endif
return 0;
+ return 0;
+ }
/*
* Do not execvp the command directly from run_init; since it would run
* under with a pty under sysadm_devpts_t. Instead, we call open_init_tty,
diff --git a/policycoreutils/sandbox/seunshare.c b/policycoreutils/sandbox/seunshare.c
index c493e98..0bc35f3 100644
--- a/policycoreutils/sandbox/seunshare.c
+++ b/policycoreutils/sandbox/seunshare.c
@@ -59,7 +59,7 @@ static int verbose = 0;
static int child = 0;
static capng_select_t cap_set = CAPNG_SELECT_BOTH;
-
+static int var_tmp_mounted = 0;
/**
* This function will drop all capabilities.
*/
@@ -292,6 +292,8 @@ static int seunshare_mount(const char *src, const char *dst, struct stat *src_st
fprintf(stderr, _("Failed to mount /var/tmp on /var/tmp: %s\n"), strerror(errno));
return -1;
}
+ var_tmp_mounted = 1;
+
if (mount("/var/tmp", "/var/tmp", NULL, MS_PRIVATE | flags, NULL) < 0) {
fprintf(stderr, _("Failed to make /var/tmp private: %s\n"), strerror(errno));
return -1;
@@ -1031,12 +1033,18 @@ childerr:
exit(-1);
}
- drop_caps();
-
/* parent waits for child exit to do the cleanup */
waitpid(child, &status, 0);
status_to_retval(status, status);
+ if (var_tmp_mounted) {
+ /* attempt to umount /var/tmp twice on exit */
+ if (umount("/var/tmp") < 0) perror("umount /var/tmp");
+ if (umount("/var/tmp") < 0) perror("umount /var/tmp");
+ }
+
+ drop_caps();
+
/* Make sure all child processes exit */
kill(-child,SIGTERM);
} /* main() */
diff --git a/policycoreutils/scripts/genhomedircon b/policycoreutils/scripts/genhomedircon
index ab696a7..58b19cd 100644
--- a/policycoreutils/scripts/genhomedircon

15
policycoreutils.spec
View File

@ -7,7 +7,7 @@
Summary: SELinux policy core utilities
Name: policycoreutils
Version: 2.1.10
Release: 1%{?dist}
Release: 3%{?dist}
License: GPLv2
Group: System Environment/Base
# Based on git repository with tag 20101221
@ -107,6 +107,10 @@ install -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/pam.d/selinux-polgengui
install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/security/console.apps/system-config-selinux
tar -jxf %{SOURCE8} -C %{buildroot}/
rm -f %{buildroot}/usr/share/man/ru/man8/genhomedircon.8.gz
rm -f %{buildroot}/usr/share/man/ru/man8/open_init_pty.8.gz
rm -f %{buildroot}/usr/share/man/man8/open_init_pty.8
rm -f %{buildroot}/usr/sbin/open_init_pty
ln -sf consolehelper %{buildroot}%{_bindir}/system-config-selinux
ln -sf /usr/share/system-config-selinux/polgengui.py %{buildroot}%{_bindir}/selinux-polgengui
%{__mkdir} -p %{buildroot}%{_sysconfdir}/bash_completion.d/
@ -267,7 +271,6 @@ rm -rf %{buildroot}
%{_sbindir}/semodule
%{_sbindir}/sestatus
%{_sbindir}/run_init
%{_sbindir}/open_init_pty
%{_bindir}/secon
%{_bindir}/semodule_deps
%{_bindir}/semodule_expand
@ -285,8 +288,6 @@ rm -rf %{buildroot}
%{_mandir}/ru/man8/fixfiles.8*
%{_mandir}/man8/load_policy.8*
%{_mandir}/ru/man8/load_policy.8*
%{_mandir}/man8/open_init_pty.8*
%{_mandir}/ru/man8/open_init_pty.8*
%{_mandir}/man8/restorecon.8*
%{_mandir}/ru/man8/restorecon.8*
%{_mandir}/man8/run_init.8*
@ -355,6 +356,12 @@ fi
/bin/systemctl try-restart restorecond.service >/dev/null 2>&1 || :
%changelog
* Thu Dec 22 2011 Dan Walsh <dwalsh@redhat.com> - 2.1.10-3
- Add umount code to seunshare to cleanup left over mounts of /var/tmp
* Wed Dec 21 2011 Dan Walsh <dwalsh@redhat.com> - 2.1.10-2
- Remove open_init_pty
* Wed Dec 21 2011 Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
-Update to upstream
- sepolgen