Attachment 144325 Details for Bug 220487 – pam_selinux patch to handle new "use_current_range" option

[patch] pam_selinux patch to handle new "use_current_range" option

pam-selinux-use-range.diff (text/plain), 2.01 KB, created by Klaus Weidner on 2006-12-23 03:38:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Klaus Weidner

Created: 2006-12-23 03:38:52 UTC

Size: 2.01 KB

patch

obsolete

>diff -urp Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c Linux-PAM-0.99.6.2-kw/modules/pam_selinux/pam_selinux.c
>--- Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c	2006-12-21 07:23:13.000000000 -0600
>+++ Linux-PAM-0.99.6.2-kw/modules/pam_selinux/pam_selinux.c	2006-12-21 07:30:42.000000000 -0600
>@@ -357,6 +357,7 @@ pam_sm_open_session(pam_handle_t *pamh, 
>   int i, debug = 0, ttys=1, has_tty=isatty(0);
>   int verbose=0, close_session=0;
>   int select_context = 0;
>+  int use_current_range = 0;
>   int ret = 0;
>   security_context_t* contextlist = NULL;
>   int num_contexts = 0;
>@@ -383,6 +384,9 @@ pam_sm_open_session(pam_handle_t *pamh, 
>     if (strcmp(argv[i], "select_context") == 0) {
>       select_context = 1;
>     }
>+    if (strcmp(argv[i], "use_current_range") == 0) {
>+      use_current_range = 1;
>+    }
>   }
> 
>   if (debug)
>@@ -449,6 +453,40 @@ pam_sm_open_session(pam_handle_t *pamh, 
>           return PAM_SUCCESS;
>     }
>   }
>+
>+  if (use_current_range && is_selinux_mls_enabled()) {
>+    security_context_t process_context=NULL;
>+    if (getcon(&process_context) == 0) {
>+      context_t pcon, ucon;
>+      char *process_level=NULL;
>+
>+      pcon = context_new(process_context);
>+      freecon(process_context);
>+      process_level = strdup(context_range_get(pcon));
>+      context_free(pcon);
>+
>+      pam_syslog (pamh, LOG_DEBUG, "process level=%s", process_level);
>+
>+      ucon = context_new(user_context);
>+      context_range_set(ucon, process_level);
>+      free(process_level);
>+
>+      if (!mls_range_allowed(user_context, context_str(ucon))) {
>+	send_text(pamh,_("Requested MLS level not in permitted range"),debug);
>+	context_free(ucon);
>+	return PAM_AUTH_ERR;
>+      }
>+
>+      pam_syslog (pamh, LOG_DEBUG, "adjusted context=%s", context_str(ucon));
>+
>+      /* replace the user context with the level adjusted one */
>+      freecon(user_context);
>+      user_context = strdup(context_str(ucon));
>+
>+      context_free(ucon);
>+    }
>+  }
>+
>   if (getexeccon(&prev_user_context)<0) {
>     prev_user_context=NULL;
>   }

Actions: View | Diff

Attachments on bug 220487: 144235 | 144260 | 144261 | 144314 | 144321 | 144325 | 144326 | 144865 | 144869 | 144870 | 144876 | 145433