Attachment 144261 Details for Bug 220487 – Another try on tidying up the patch

[patch] Another try on tidying up the patch

openssh-4.3p2-mls.patch (text/plain), 2.13 KB, created by Tomas Mraz on 2006-12-22 09:28:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Mraz

Created: 2006-12-22 09:28:59 UTC

Size: 2.13 KB

patch

obsolete

>--- openssh-4.3p2/selinux.c.mls	2006-12-22 10:04:19.000000000 +0100
>+++ openssh-4.3p2/selinux.c	2006-12-22 10:19:10.000000000 +0100
>@@ -8,7 +8,24 @@
> #include <selinux/context.h>
> #include <selinux/get_context_list.h>
> #include <selinux/get_default_type.h>
>+#include <selinux/av_permissions.h>
>+
> extern Authctxt *the_authctxt;
>+extern int inetd_flag;
>+
>+/* from Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c */
>+static int mls_range_allowed(security_context_t src, security_context_t dst)
>+{
>+  struct av_decision avd;
>+  int retval;
>+  unsigned int bit = CONTEXT__CONTAINS;
>+  
>+  retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);
>+  if (retval || ((bit & avd.allowed) != bit))
>+    return 0;
>+  
>+  return 1;
>+}
> 
> static const security_context_t selinux_get_user_context(const char *name) {
> 	security_context_t user_context=NULL;
>@@ -25,6 +42,39 @@
> 			ret=get_default_context_with_rolelevel(seuser, role, level,NULL,&user_context);
> 		else
> 			ret=get_default_context_with_level(seuser, level, NULL,&user_context);
>+		if (inetd_flag && ret >= 0) {
>+			security_context_t sshd_context = NULL;
>+			security_context_t user_level_context=NULL;
>+			char *connection_level=NULL;
>+			context_t con;
>+
>+			if (getcon(&sshd_context) < 0)
>+				fatal("failed to allocate security context");
>+
>+			con = context_new(sshd_context);
>+			connection_level = strdup(context_range_get(con));
>+			context_free(con);
>+
>+			freecon(sshd_context);
>+
>+			debug("selinux_get_user_context: current connection level '%s'", connection_level);
>+
>+			if (role != NULL && role[0]) 
>+				ret=get_default_context_with_rolelevel(seuser, role, connection_level, NULL, &user_level_context);
>+			else
>+				ret=get_default_context_with_level(seuser, connection_level, NULL, &user_level_context);
>+
>+			if (mls_range_allowed(user_context, user_level_context)) {
>+				logit("permit MLS level %s (user range %s)", connection_level, level);
>+				freecon(user_context);
>+				user_context = user_level_context;
>+			} else {
>+				fatal("deny MLS level %s (user range %s)", connection_level, level);
>+			}
>+
>+			if (connection_level)
>+				free(connection_level);
>+		}
> 	}
> 
> 	if ( ret < 0 ) {

Actions: View | Diff

Attachments on bug 220487: 144235 | 144260 | 144261 | 144314 | 144321 | 144325 | 144326 | 144865 | 144869 | 144870 | 144876 | 145433