123 lines
4.1 KiB
Diff
123 lines
4.1 KiB
Diff
From ec300fdabb27c41258cf5aea91dae518a3b88a04 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
Date: Mon, 21 Jul 2014 20:41:19 -0400
|
|
Subject: [PATCH] sysusers: fix selinux context of backup files
|
|
|
|
Also, fix fopen_temporary_label to set proper context. By chance,
|
|
all users so far used the same context, so the error didn't matter.
|
|
|
|
Also, check return value from label_init().
|
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1121806
|
|
(cherry picked from commit 9f1c19405a1ccaf59dcc8c32c13a1619541189ad)
|
|
---
|
|
src/shared/fileio-label.c | 2 +-
|
|
src/sysusers/sysusers.c | 45 ++++++++++++++++++++++++---------------------
|
|
2 files changed, 25 insertions(+), 22 deletions(-)
|
|
|
|
diff --git a/src/shared/fileio-label.c b/src/shared/fileio-label.c
|
|
index 417ca5695a..c3def3c568 100644
|
|
--- a/src/shared/fileio-label.c
|
|
+++ b/src/shared/fileio-label.c
|
|
@@ -59,7 +59,7 @@ int fopen_temporary_label(const char *target,
|
|
const char *path, FILE **f, char **temp_path) {
|
|
int r;
|
|
|
|
- r = label_context_set("/etc/passwd", S_IFREG);
|
|
+ r = label_context_set(target, S_IFREG);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
|
|
index bf2fbbc252..2387d5873a 100644
|
|
--- a/src/sysusers/sysusers.c
|
|
+++ b/src/sysusers/sysusers.c
|
|
@@ -195,8 +195,9 @@ static int load_group_database(void) {
|
|
return 0;
|
|
}
|
|
|
|
-static int make_backup(const char *x) {
|
|
- _cleanup_close_ int src = -1, dst = -1;
|
|
+static int make_backup(const char *target, const char *x) {
|
|
+ _cleanup_close_ int src = -1;
|
|
+ _cleanup_fclose_ FILE *dst = NULL;
|
|
char *backup, *temp;
|
|
struct timespec ts[2];
|
|
struct stat st;
|
|
@@ -213,30 +214,30 @@ static int make_backup(const char *x) {
|
|
if (fstat(src, &st) < 0)
|
|
return -errno;
|
|
|
|
- temp = strappenda(x, ".XXXXXX");
|
|
- dst = mkostemp_safe(temp, O_WRONLY|O_CLOEXEC|O_NOCTTY);
|
|
- if (dst < 0)
|
|
- return dst;
|
|
+ r = fopen_temporary_label(target, x, &dst, &temp);
|
|
+ if (r < 0)
|
|
+ return r;
|
|
|
|
- r = copy_bytes(src, dst, (off_t) -1);
|
|
+ r = copy_bytes(src, fileno(dst), (off_t) -1);
|
|
if (r < 0)
|
|
goto fail;
|
|
|
|
+ /* Don't fail on chmod() or chown(). If it stays owned by us
|
|
+ * and/or unreadable by others, then it isn't too bad... */
|
|
+
|
|
+ backup = strappenda(x, "-");
|
|
+
|
|
/* Copy over the access mask */
|
|
- if (fchmod(dst, st.st_mode & 07777) < 0) {
|
|
- r = -errno;
|
|
- goto fail;
|
|
- }
|
|
+ if (fchmod(fileno(dst), st.st_mode & 07777) < 0)
|
|
+ log_warning("Failed to change mode on %s: %m", backup);
|
|
|
|
- /* Don't fail on chmod(). If it stays owned by us, then it
|
|
- * isn't too bad... */
|
|
- fchown(dst, st.st_uid, st.st_gid);
|
|
+ if (fchown(fileno(dst), st.st_uid, st.st_gid)< 0)
|
|
+ log_warning("Failed to change ownership of %s: %m", backup);
|
|
|
|
ts[0] = st.st_atim;
|
|
ts[1] = st.st_mtim;
|
|
- futimens(dst, ts);
|
|
+ futimens(fileno(dst), ts);
|
|
|
|
- backup = strappenda(x, "-");
|
|
if (rename(temp, backup) < 0)
|
|
goto fail;
|
|
|
|
@@ -469,13 +470,13 @@ static int write_files(void) {
|
|
|
|
/* Make a backup of the old files */
|
|
if (group && group_changed) {
|
|
- r = make_backup(group_path);
|
|
+ r = make_backup("/etc/group", group_path);
|
|
if (r < 0)
|
|
goto finish;
|
|
}
|
|
|
|
if (passwd) {
|
|
- r = make_backup(passwd_path);
|
|
+ r = make_backup("/etc/passwd", passwd_path);
|
|
if (r < 0)
|
|
goto finish;
|
|
}
|
|
@@ -1529,9 +1530,11 @@ int main(int argc, char *argv[]) {
|
|
|
|
umask(0022);
|
|
|
|
- label_init(NULL);
|
|
-
|
|
- r = 0;
|
|
+ r = label_init(NULL);
|
|
+ if (r < 0) {
|
|
+ log_error("SELinux setup failed: %s", strerror(-r));
|
|
+ goto finish;
|
|
+ }
|
|
|
|
if (optind < argc) {
|
|
int j;
|