From d355fd3326286a01f82c5c46a8eb99ae2f4a11bb Mon Sep 17 00:00:00 2001 Message-Id: From: Andy Lutomirski Date: Wed, 30 Apr 2014 21:59:37 -0700 Subject: [PATCH] seunshare: Try to use setcurrent before setexec If seunshare uses PR_SET_NO_NEW_PRIVS, which certain versions of libcap-ng set, setexeccon will cause execve to fail. This also makes setting selinux context the very last action taken by seunshare prior to exec, as it may otherwise cause things to fail. Note that this won't work without adjusting the system policy to allow this use of setcurrent. This rule appears to work: allow unconfined_t sandbox_t:process dyntransition; although a better rule would probably relax the unconfined_t restriction. Signed-off-by: Andy Lutomirski --- policycoreutils/sandbox/seunshare.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/policycoreutils/sandbox/seunshare.c b/policycoreutils/sandbox/seunshare.c index 97f3920..fe40757 100644 --- a/policycoreutils/sandbox/seunshare.c +++ b/policycoreutils/sandbox/seunshare.c @@ -1032,17 +1032,25 @@ int main(int argc, char **argv) { goto childerr; } - /* selinux context */ - if (execcon && setexeccon(execcon) != 0) { - fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno)); - goto childerr; - } - if (chdir(pwd->pw_dir)) { perror(_("Failed to change dir to homedir")); goto childerr; } setsid(); + + /* selinux context */ + if (execcon) { + /* try dyntransition, since no_new_privs can interfere + * with setexeccon */ + if (setcon(execcon) != 0) { + /* failed; fall back to setexeccon */ + if (setexeccon(execcon) != 0) { + fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno)); + goto childerr; + } + } + } + execv(argv[optind], argv + optind); fprintf(stderr, _("Failed to execute command %s: %s\n"), argv[optind], strerror(errno)); childerr: -- 1.9.0