Attachment 144314 Details for Bug 220487 – updated patch

[patch] updated patch

openssh-xinetd-MLS-kw2.diff (text/plain), 2.59 KB, created by Klaus Weidner on 2006-12-22 21:58:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Klaus Weidner

Created: 2006-12-22 21:58:18 UTC

Size: 2.59 KB

patch

obsolete

>--- openssh-4.3p2/selinux.c	2006-12-21 07:13:41.000000000 -0600
>+++ openssh-4.3p2-kw/selinux.c	2006-12-21 07:13:13.000000000 -0600
>@@ -8,7 +8,34 @@
> #include <selinux/context.h>
> #include <selinux/get_context_list.h>
> #include <selinux/get_default_type.h>
>+#include <selinux/av_permissions.h>
>+
> extern Authctxt *the_authctxt;
>+extern int inetd_flag;
>+
>+/* from Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c */
>+static int mls_range_allowed(security_context_t src, security_context_t dst)
>+{
>+  struct av_decision avd;
>+  int retval;
>+  unsigned int bit = CONTEXT__CONTAINS;
>+  
>+  retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);
>+  if (retval || ((bit & avd.allowed) != bit))
>+    return 0;
>+  
>+  return 1;
>+}
>+
>+
>+static int
>+get_user_context(char* user, char* role, char *level, security_context_t *user_context)
>+{
>+	if (role != NULL && role[0]) 
>+		return get_default_context_with_rolelevel(user, role, level, NULL, user_context);
>+	else
>+		return get_default_context_with_level(user, level, NULL, user_context);
>+}
> 
> static const security_context_t selinux_get_user_context(const char *name) {
> 	security_context_t user_context=NULL;
>@@ -21,10 +48,40 @@
> 		role=the_authctxt->role;
> 
> 	if (getseuserbyname(name, &seuser, &level)==0) {
>-		if (role != NULL && role[0]) 
>-			ret=get_default_context_with_rolelevel(seuser, role, level,NULL,&user_context);
>-		else
>-			ret=get_default_context_with_level(seuser, level, NULL,&user_context);
>+		ret=get_user_context(seuser, role, level, &user_context);
>+		if (inetd_flag && ret >= 0) {
>+			security_context_t sshd_context=NULL;
>+			security_context_t user_level_context=NULL;
>+			char *connection_level=NULL;
>+			context_t con;
>+
>+			if (getcon(&sshd_context) < 0)
>+				fatal("failed to allocate security context");
>+
>+			con = context_new(sshd_context);
>+			connection_level = strdup(context_range_get(con));
>+			context_free(con);
>+
>+			freecon(sshd_context);
>+
>+			debug("selinux_get_user_context: current connection level '%s'", connection_level);
>+
>+			ret=get_user_context(seuser, role, connection_level, &user_level_context);
>+
>+			if (mls_range_allowed(user_context, user_level_context)) {
>+				logit("permit MLS level %s (user range %s)", connection_level, level);
>+				freecon(user_context);
>+				user_context = user_level_context;
>+			} else {
>+				if (security_getenforce() > 0) 
>+					fatal("deny MLS level %s (user range %s)", connection_level, level);
>+				else 
>+					error("deny MLS level %s (user range %s). Continuing in permissive mode", connection_level, level);
>+			}
>+
>+			if (connection_level)
>+				free(connection_level);
>+		}
> 	}
> 
> 	if ( ret < 0 ) {

Actions: View | Diff

Attachments on bug 220487: 144235 | 144260 | 144261 | 144314 | 144321 | 144325 | 144326 | 144865 | 144869 | 144870 | 144876 | 145433