Attachment 145433 Details for Bug 220487 – Applied patch to openssh

[patch] Applied patch to openssh

openssh-4.3p2-mls.patch (text/plain), 6.49 KB, created by Tomas Mraz on 2007-01-12 08:02:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Mraz

Created: 2007-01-12 08:02:56 UTC

Size: 6.49 KB

patch

obsolete

>--- openssh-4.3p2/selinux.c.mls	2007-01-11 14:22:40.000000000 +0100
>+++ openssh-4.3p2/selinux.c	2007-01-11 20:25:27.000000000 +0100
>@@ -1,6 +1,7 @@
> #include "includes.h"
> #include "auth.h"
> #include "log.h"
>+#include "xmalloc.h"
> 
> #ifdef WITH_SELINUX
> #include <selinux/selinux.h>
>@@ -8,23 +9,147 @@
> #include <selinux/context.h>
> #include <selinux/get_context_list.h>
> #include <selinux/get_default_type.h>
>+#include <selinux/av_permissions.h>
>+
>+#ifdef HAVE_LINUX_AUDIT
>+#include <libaudit.h>
>+#include <sys/select.h>
>+#include <errno.h>
>+#endif
>+
> extern Authctxt *the_authctxt;
>+extern int inetd_flag;
>+extern int rexeced_flag;
>+
>+/* Send audit message */
>+static int send_audit_message(int success, security_context_t default_context,
>+		       security_context_t selected_context)
>+{
>+	int rc=0;
>+#ifdef HAVE_LINUX_AUDIT
>+	char *msg = NULL;
>+	int audit_fd = audit_open();
>+	security_context_t default_raw=NULL;
>+	security_context_t selected_raw=NULL;
>+	rc = -1;
>+	if (audit_fd < 0) {
>+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||
>+                                        errno == EAFNOSUPPORT)
>+                        return 0; /* No audit support in kernel */
>+		error("Error connecting to audit system.");
>+		return rc;
>+	}
>+	if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) {
>+		error("Error translating default context.");
>+		goto out;
>+	}
>+	if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) {
>+		error("Error translating selected context.");
>+		goto out;
>+	}
>+	if (asprintf(&msg, "sshd: default-context=%s selected-context=%s",
>+		     default_context ? default_raw : "?",
>+		     selected_context ? selected_raw : "?") < 0) {
>+		error("Error allocating memory.");
>+		goto out;
>+	}
>+	if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
>+				   msg, NULL, NULL, NULL, success) <= 0) {
>+		error("Error sending audit message.");
>+		goto out;
>+	}
>+	rc = 0;
>+      out:
>+	free(msg);
>+	freecon(default_raw);
>+	freecon(selected_raw);
>+	close(audit_fd);
>+#endif
>+	return rc;
>+}
>+/* from Linux-PAM-0.99.6.2/modules/pam_selinux/pam_selinux.c */
>+static int mls_range_allowed(security_context_t src, security_context_t dst)
>+{
>+	struct av_decision avd;
>+	int retval;
>+	unsigned int bit = CONTEXT__CONTAINS;
>+
>+	retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);
>+	if (retval || ((bit & avd.allowed) != bit))
>+		return 0;
>+
>+	return 1;
>+}
>+
>+static int get_user_context(const char *user, const char *role, const char *level,
>+	security_context_t *context) {
>+	if (role != NULL && role[0]) 
>+		return get_default_context_with_rolelevel(user, role, level, NULL, context);
>+	else
>+		return get_default_context_with_level(user, level, NULL, context);
>+}
> 
> static const security_context_t selinux_get_user_context(const char *name) {
> 	security_context_t user_context=NULL;
>+	security_context_t default_context=NULL;
>+	char *seuser=NULL;
> 	char *role=NULL;
> 	int ret=-1;
>-	char *seuser=NULL;
>-	char *level=NULL;
>-
>-	if (the_authctxt) 
>-		role=the_authctxt->role;
>+	char *dlevel=NULL;
>+	const char *rlevel=NULL;
>+	context_t con=NULL;
>+
>+	if (the_authctxt) {
>+		if (the_authctxt->role != NULL) {
>+			char *slash;
>+			role = xstrdup(the_authctxt->role);
>+			if ((slash = strchr(role, '/')) != NULL) {
>+				*slash = '\0';
>+				rlevel = slash + 1;
>+			}
>+		}
>+	}
>+	
>+	ret = getseuserbyname(name, &seuser, &dlevel);
>+	
>+	if (ret >= 0) {
>+		ret = get_user_context(seuser, role, dlevel, &default_context);
>+	}
>+	
>+	if (ret >= 0) {
>+		/* If launched from xinetd, we must use current level */
>+		if (inetd_flag && !rexeced_flag) {
>+			security_context_t sshd_context=NULL;
>+
>+			if (getcon(&sshd_context) < 0)
>+				fatal("failed to allocate security context");
>+
>+			con = context_new(sshd_context);
>+			rlevel = context_range_get(con);
>+			freecon(sshd_context);
> 
>-	if (getseuserbyname(name, &seuser, &level)==0) {
>-		if (role != NULL && role[0]) 
>-			ret=get_default_context_with_rolelevel(seuser, role, level,NULL,&user_context);
>-		else
>-			ret=get_default_context_with_level(seuser, level, NULL,&user_context);
>+			debug("selinux_get_user_context: current connection level '%s'", rlevel);
>+		}
>+		
>+		if (rlevel != NULL && rlevel[0]) {
>+			ret = get_user_context(seuser, role, rlevel, &user_context);
>+		
>+			if (ret >= 0) {
>+				if (mls_range_allowed(default_context, user_context)) {
>+					send_audit_message(1, default_context, user_context);
>+					logit("permit MLS level %s (user range %s)", rlevel, dlevel);
>+				} else {
>+					send_audit_message(0, default_context, user_context);
>+					if (security_getenforce() > 0) 
>+						fatal("deny MLS level %s (user range %s)", rlevel, dlevel);
>+					else 
>+						error("deny MLS level %s (user range %s). Continuing in permissive mode", rlevel, dlevel);
>+				}
>+			}
>+			freecon(default_context);
>+		} else {
>+			user_context = default_context;
>+		}
> 	}
> 
> 	if ( ret < 0 ) {
>@@ -32,7 +157,13 @@
> 			fatal("Failed to get default security context for %s.", name);
> 		else 
> 			error("Failed to get default security context for %s. Continuing in permissive mode", name);
>-	} 
>+	}
>+	
>+	if (con)
>+		context_free(con);
>+	free(role);
>+	free(seuser);
>+	free(dlevel);
> 	return user_context;
> }
> 
>@@ -40,11 +171,15 @@
> 	if (is_selinux_enabled() > 0) {
> 		security_context_t new_tty_context=NULL, user_context=NULL, old_tty_context=NULL; 
> 
>-		user_context=selinux_get_user_context(name);
>+		if (getexeccon(&user_context) < 0) {
>+			error("getexeccon() failed: %.100s", strerror(errno));
>+			return;
>+		}
> 
> 		if (getfilecon(tty, &old_tty_context) < 0) {
> 			error("getfilecon(%.100s) failed: %.100s", tty, strerror(errno));
> 		} else {
>+			debug("user_context: %s old_tty_context: %s", user_context, old_tty_context);
> 			if (security_compute_relabel(user_context,old_tty_context,
> 						     SECCLASS_CHR_FILE,
> 						     &new_tty_context) != 0) {
>--- openssh-4.3p2/sshd.c.mls	2007-01-11 14:22:40.000000000 +0100
>+++ openssh-4.3p2/sshd.c	2007-01-11 14:22:40.000000000 +0100
>@@ -85,6 +85,7 @@
> #include "monitor.h"
> #include "monitor_wrap.h"
> #include "monitor_fdpass.h"
>+#include "selinux.h"
> 
> #ifdef LIBWRAP
> #include <tcpd.h>
>@@ -1752,6 +1753,7 @@
> 		restore_uid();
> 	}
> #endif
>+	setup_selinux_exec_context(authctxt->pw->pw_name); 
> #ifdef USE_PAM
> 	if (options.use_pam) {
> 		do_pam_setcred(1);
>--- openssh-4.3p2/session.c.mls	2007-01-11 14:22:40.000000000 +0100
>+++ openssh-4.3p2/session.c	2007-01-11 14:22:40.000000000 +0100
>@@ -1313,8 +1313,6 @@
> #endif
> 	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
> 		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
>-
>-	setup_selinux_exec_context(pw->pw_name);
> }
> 
> static void

Actions: View | Diff

Attachments on bug 220487: 144235 | 144260 | 144261 | 144314 | 144321 | 144325 | 144326 | 144865 | 144869 | 144870 | 144876 | 145433