From d2d52704624ce841f4a392fccd82079d87ff13b6 Mon Sep 17 00:00:00 2001 From: Jan Grulich Date: Thu, 11 Nov 2021 13:52:41 +0100 Subject: [PATCH] SELinux: restore SELinux context in case of different policies --- CMakeLists.txt | 13 +++++++++++++ unix/vncserver/CMakeLists.txt | 2 +- unix/vncserver/vncsession.c | 16 ++++++++++++++++ 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7bf9944..85be468 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -276,6 +276,19 @@ if(UNIX AND NOT APPLE) endif() endif() +# Check for SELinux library +if(UNIX AND NOT APPLE) + check_include_files(selinux/selinux.h HAVE_SELINUX_H) + if(HAVE_SELINUX_H) + set(CMAKE_REQUIRED_LIBRARIES -lselinux) + set(CMAKE_REQUIRED_LIBRARIES) + set(SELINUX_LIBS selinux) + add_definitions("-DHAVE_SELINUX") + else() + message(WARNING "Could not find SELinux development files") + endif() +endif() + # Generate config.h and make sure the source finds it configure_file(config.h.in config.h) add_definitions(-DHAVE_CONFIG_H) diff --git a/unix/vncserver/CMakeLists.txt b/unix/vncserver/CMakeLists.txt index eeb4b7b..bce1c3e 100644 --- a/unix/vncserver/CMakeLists.txt +++ b/unix/vncserver/CMakeLists.txt @@ -1,5 +1,5 @@ add_executable(vncsession vncsession.c) -target_link_libraries(vncsession ${PAM_LIBS}) +target_link_libraries(vncsession ${PAM_LIBS} ${SELINUX_LIBS}) configure_file(vncserver@.service.in vncserver@.service @ONLY) configure_file(vncsession-start.in vncsession-start @ONLY) diff --git a/unix/vncserver/vncsession.c b/unix/vncserver/vncsession.c index f78c096..141f689 100644 --- a/unix/vncserver/vncsession.c +++ b/unix/vncserver/vncsession.c @@ -37,6 +37,11 @@ #include #include +#ifdef HAVE_SELINUX +#include +#include +#endif + extern char **environ; // PAM service name @@ -359,6 +364,17 @@ redir_stdio(const char *homedir, const char *display) perror("mkdir"); _exit(EX_OSERR); } + +#ifdef HAVE_SELINUX + int result; + if (selinux_file_context_verify(logfile, 0) == 0) { + result = selinux_restorecon(logfile, SELINUX_RESTORECON_RECURSE); + + if (result < 0) { + syslog(LOG_WARNING, "Failure restoring SELinux context for \"%s\": %s", logfile, strerror(errno)); + } + } +#endif } if (gethostname(hostname, sizeof(hostname)) == -1) {