rpms/policycoreutils
5
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix newrole to retain cap_audit_write when compiled with namespace, also

Browse Source 
do not drop capabilities when run as root.
This commit is contained in:
Dan Walsh 2013-02-18 14:14:39 -05:00
parent 5855410892
commit 68cfa786ad
2 changed files with 36 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
policycoreutils-rhat.patch
View File

@ -338,10 +338,35 @@ new file mode 100644
index 0000000..68ffcb7 index 0000000..68ffcb7
Binary files /dev/null and b/policycoreutils/gui/system-config-selinux.png differ Binary files /dev/null and b/policycoreutils/gui/system-config-selinux.png differ
diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c
index 8fbf2d0..3753ef4 100644 index 8fbf2d0..3510f12 100644
--- a/policycoreutils/newrole/newrole.c --- a/policycoreutils/newrole/newrole.c
+++ b/policycoreutils/newrole/newrole.c +++ b/policycoreutils/newrole/newrole.c
@@ -680,7 +680,7 @@ static int relabel_tty(const char *ttyn, security_context_t new_context, @@ -576,19 +576,22 @@ static int drop_capabilities(int full)
*/
static int drop_capabilities(int full)
{
+ uid_t uid = getuid();
+ if (!uid) return 0;
+
capng_setpid(getpid());
capng_clear(CAPNG_SELECT_BOTH);
if (capng_lock() < 0)
return -1;
- uid_t uid = getuid();
/* Change uid */
if (setresuid(uid, uid, uid)) {
fprintf(stderr, _("Error changing uid, aborting.\n"));
return -1;
}
if (! full)
- capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, CAP_SYS_ADMIN , CAP_FOWNER , CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, -1);
+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, CAP_SYS_ADMIN , CAP_FOWNER , CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, CAP_AUDIT_WRITE, -1);
+
return capng_apply(CAPNG_SELECT_BOTH);
}
@@ -680,7 +683,7 @@ static int relabel_tty(const char *ttyn, security_context_t new_context,
security_context_t * tty_context, security_context_t * tty_context,
security_context_t * new_tty_context) security_context_t * new_tty_context)
{ {
@ -350,7 +375,7 @@ index 8fbf2d0..3753ef4 100644
int enforcing = security_getenforce(); int enforcing = security_getenforce();
security_context_t tty_con = NULL; security_context_t tty_con = NULL;
security_context_t new_tty_con = NULL; security_context_t new_tty_con = NULL;
@@ -699,7 +699,13 @@ static int relabel_tty(const char *ttyn, security_context_t new_context, @@ -699,7 +702,13 @@ static int relabel_tty(const char *ttyn, security_context_t new_context,
fprintf(stderr, _("Error! Could not open %s.\n"), ttyn); fprintf(stderr, _("Error! Could not open %s.\n"), ttyn);
return fd; return fd;
} }
@ -365,7 +390,7 @@ index 8fbf2d0..3753ef4 100644
if (fgetfilecon(fd, &tty_con) < 0) { if (fgetfilecon(fd, &tty_con) < 0) {
fprintf(stderr, _("%s! Could not get current context " fprintf(stderr, _("%s! Could not get current context "
@@ -1010,9 +1016,9 @@ int main(int argc, char *argv[]) @@ -1010,9 +1019,9 @@ int main(int argc, char *argv[])
int fd; int fd;
pid_t childPid = 0; pid_t childPid = 0;
char *shell_argv0 = NULL; char *shell_argv0 = NULL;
@ -376,7 +401,7 @@ index 8fbf2d0..3753ef4 100644
int pam_status; /* pam return code */ int pam_status; /* pam return code */
pam_handle_t *pam_handle; /* opaque handle used by all PAM functions */ pam_handle_t *pam_handle; /* opaque handle used by all PAM functions */
@@ -1226,15 +1232,23 @@ int main(int argc, char *argv[]) @@ -1226,15 +1235,23 @@ int main(int argc, char *argv[])
fd = open(ttyn, O_RDONLY | O_NONBLOCK); fd = open(ttyn, O_RDONLY | O_NONBLOCK);
if (fd != 0) if (fd != 0)
goto err_close_pam; goto err_close_pam;

8
policycoreutils.spec
View File

@ -7,7 +7,7 @@
Summary: SELinux policy core utilities Summary: SELinux policy core utilities
Name: policycoreutils Name: policycoreutils
Version: 2.1.14 Version: 2.1.14
Release: 5%{?dist} Release: 6%{?dist}
License: GPLv2 License: GPLv2
Group: System Environment/Base Group: System Environment/Base
# Based on git repository with tag 20101221 # Based on git repository with tag 20101221
@ -209,7 +209,7 @@ or level of a logged in user.
%files newrole %files newrole
%defattr(-,root,root) %defattr(-,root,root)
%attr(0755,root,root) %caps(cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole
%{_mandir}/man1/newrole.1.gz %{_mandir}/man1/newrole.1.gz
%config(noreplace) %{_sysconfdir}/pam.d/newrole %config(noreplace) %{_sysconfdir}/pam.d/newrole
@ -326,6 +326,10 @@ The policycoreutils-restorecond package contains the restorecond service.
%{_bindir}/systemctl try-restart restorecond.service >/dev/null 2>&1 || : %{_bindir}/systemctl try-restart restorecond.service >/dev/null 2>&1 || :
%changelog %changelog
* Mon Feb 18 2013 Dan Walsh <dwalsh@redhat.com> - 2.1.14-6
- Fix newrole to retain cap_audit_write when compiled with namespace, also
do not drop capabilities when run as root.
* Thu Feb 14 2013 Dan Walsh <dwalsh@redhat.com> - 2.1.14-5 * Thu Feb 14 2013 Dan Walsh <dwalsh@redhat.com> - 2.1.14-5
- Fix man page generation and public_content description - Fix man page generation and public_content description