Attachment 144235 Details for Bug 220487 – proposed openssh patch to support MLS networking

[patch] proposed openssh patch to support MLS networking

openssh-xinetd-MLS.diff (text/plain), 2.20 KB, created by Klaus Weidner on 2006-12-22 00:32:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Klaus Weidner

Created: 2006-12-22 00:32:53 UTC

Size: 2.20 KB

patch

obsolete

>diff -ur BUILD/openssh-4.3p2/selinux.c kw-mod/openssh-4.3p2/selinux.c
>--- BUILD/openssh-4.3p2/selinux.c	2006-12-20 22:00:17.000000000 -0600
>+++ kw-mod/openssh-4.3p2/selinux.c	2006-12-20 22:08:19.000000000 -0600
>@@ -8,7 +8,24 @@
> #include <selinux/context.h>
> #include <selinux/get_context_list.h>
> #include <selinux/get_default_type.h>
>+#include <selinux/av_permissions.h>
>+
> extern Authctxt *the_authctxt;
>+extern int inetd_flag;
>+
>+/* from Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c */
>+static int mls_range_allowed(security_context_t src, security_context_t dst)
>+{
>+  struct av_decision avd;
>+  int retval;
>+  unsigned int bit = CONTEXT__CONTAINS;
>+  
>+  retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);
>+  if (retval || ((bit & avd.allowed) != bit))
>+    return 0;
>+  
>+  return 1;
>+}
> 
> static const security_context_t selinux_get_user_context(const char *name) {
> 	security_context_t user_context=NULL;
>@@ -25,6 +42,40 @@
> 			ret=get_default_context_with_rolelevel(seuser, role, level,NULL,&user_context);
> 		else
> 			ret=get_default_context_with_level(seuser, level, NULL,&user_context);
>+
>+		if (inetd_flag) {
>+			security_context_t sshd_context = NULL;
>+			security_context_t user_level_context = NULL;
>+			char *connection_level=NULL;
>+			context_t con;
>+			int ret2=-1;
>+
>+			if (getcon(&sshd_context) < 0)
>+				fatal("failed to allocate security context");
>+
>+			con = context_new(sshd_context);
>+			connection_level = strdup(context_range_get(con));
>+			context_free(con);
>+
>+			freecon(sshd_context);
>+
>+			debug("selinux_get_user_context: current connection level '%s'", connection_level);
>+
>+			if (role != NULL && role[0]) 
>+				ret2=get_default_context_with_rolelevel(seuser, role, connection_level,NULL,&user_level_context);
>+			else
>+				ret2=get_default_context_with_level(seuser, connection_level, NULL,&user_level_context);
>+
>+			if (mls_range_allowed(user_context, user_level_context)) {
>+				logit("permit MLS level %s (user range %s)", connection_level, level);
>+				user_context = user_level_context;
>+				ret = ret2;
>+			} else {
>+				fatal("deny MLS level %s (user range %s)", connection_level, level);
>+			}
>+
>+			if (connection_level) free(connection_level);
>+		}
> 	}
> 
> 	if ( ret < 0 ) {

Actions: View | Diff

Attachments on bug 220487: 144235 | 144260 | 144261 | 144314 | 144321 | 144325 | 144326 | 144865 | 144869 | 144870 | 144876 | 145433