Attachment 153655 Details for Bug 237876 – patch

[patch] patch

pam-0.99.7.0-namespace-method-change.patch (text/plain), 6.60 KB, created by Ted X Toth on 2007-04-27 18:22:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ted X Toth

Created: 2007-04-27 18:22:11 UTC

Size: 6.60 KB

patch

obsolete

>--- Linux-PAM-0.99.7.0/modules/pam_namespace/pam_namespace.c	2007-04-26 16:00:14.000000000 -0500
>+++ Linux-PAM-0.99.7.0.new/modules/pam_namespace/pam_namespace.c	2007-04-26 15:07:27.000000000 -0500
>@@ -31,6 +31,7 @@
>  */
> 
> #include "pam_namespace.h"
>+#include "libpam/pam_private.h"
> 
> /*
>  * Copies the contents of ent into pent
>@@ -251,21 +252,15 @@
> 
>     poly.method = NONE;
>     if (strcmp(method, "user") == 0) 
>-	    poly.method = USER;
>+        poly.method = USER;
> 
> #ifdef WITH_SELINUX
>     if (strcmp(method, "level") == 0) {
>-        if (idata->flags & PAMNS_CTXT_BASED_INST)
>-            poly.method = LEVEL;
>-	else
>-            poly.method = USER;
>+        poly.method = LEVEL;
>     }
> 
>     if (strcmp(method, "context") == 0) {
>-        if (idata->flags & PAMNS_CTXT_BASED_INST)
>-            poly.method = CONTEXT;
>-	else
>-            poly.method = USER;
>+        poly.method = CONTEXT;
>     }
> 
> #endif
>@@ -447,6 +442,7 @@
> 	int rc = PAM_SUCCESS;
> 	security_context_t scon = NULL;
> 	security_class_t tclass;
>+	char *selinuxuser, *level;
> 
> 	/*
> 	 * Get the security context of the directory to polyinstantiate.
>@@ -460,11 +456,65 @@
> 
> 	if (polyptr->method == USER) return PAM_SUCCESS;
> 
>-	rc = getexeccon(&scon);
>-	if (rc < 0 || scon == NULL) {
>+	/*
>+	  If we're running in su and su_getcon was specified 
>+	  use getcon to get the context
>+	*/
>+	if (strcmp(idata->pamh->service_name, "su") == 0) {
>+	  if (idata->flags & PAMNS_SU_GETCON) {
>+	    rc = getcon(&scon);
>+	    if (rc < 0 || scon == NULL) {
>+	      pam_syslog(idata->pamh, LOG_ERR, 
>+			 "Error getting context, %m");
>+	      return PAM_SESSION_ERR;
>+	    }
>+	  }
>+	  else {
>+	    if (idata->flags & PAMNS_DEBUG)
>+	      pam_syslog(idata->pamh, LOG_DEBUG,
>+			 "Use su_getcon option if you want to polyinstantiate based on su's context.");
>+	    return PAM_SESSION_ERR;
>+	  }
>+	}
>+	else {
>+	  /*
>+	    Check whether setexeccon was called prior to opening the pam session.
>+	   */
>+	  rc = getexeccon(&scon);
>+	  if (rc < 0 || scon == NULL) {
>+	    /*
>+	      setexeccon wasn't called. If user_default_context_fallback was set
>+	      use the users default context.
>+	    */
>+	    if (idata->flags & PAMNS_USER_DEFAULT_CONTEXT_FALLBACK) {
>+	      rc = getseuserbyname(idata->user, &selinuxuser, &level);
>+	      if (rc < 0) {
> 		pam_syslog(idata->pamh, LOG_ERR, 
>-			   "Error getting exec context, %m");
>+			   "Error getting selinux user, %m");
> 		return PAM_SESSION_ERR;
>+	      }
>+	      if (idata->flags & PAMNS_DEBUG)
>+		pam_syslog(idata->pamh, LOG_DEBUG,
>+			   "selinux user %s level %s", selinuxuser, level);
>+	      
>+	      rc = get_default_context_with_level(selinuxuser, level, NULL, &scon);
>+	      free(selinuxuser);
>+	      free(level);
>+	      if (rc < 0) {
>+		pam_syslog(idata->pamh, LOG_ERR, 
>+			   "Error getting selinux user default context, %m");
>+		return PAM_SESSION_ERR;
>+	      }
>+	      if (idata->flags & PAMNS_DEBUG)
>+		pam_syslog(idata->pamh, LOG_DEBUG,
>+			   "selinux user default context %s", scon);
>+	    }
>+	    else {
>+	      pam_syslog(idata->pamh, LOG_ERR, 
>+			 "Error no available context because setexeccon has not been called.");
>+	      return PAM_SESSION_ERR;
>+	    }
>+	  }
> 	}
> 
> 	/*
>@@ -515,6 +565,10 @@
> 			pam_syslog(idata->pamh, LOG_ERR, "Unable to set MLS Componant of context");
> 			goto fail;
> 		}
>+		if (idata->flags & PAMNS_DEBUG)
>+		  pam_syslog(idata->pamh, LOG_DEBUG,
>+			     "context_range_set %s %s", context_str(fcontext), context_str(scontext));
>+
> 		*i_context=strdup(context_str(fcontext));
> 		if (! *i_context) {
> 			pam_syslog(idata->pamh, LOG_ERR, "out of memory");
>@@ -569,6 +623,9 @@
> # ifdef WITH_SELINUX
>     char *filename = NULL;
>     rc = form_context(polyptr, i_context, origcon, idata);
>+    if (rc != PAM_SUCCESS) {
>+      return rc;
>+    }
> #endif
>     rc = PAM_SUCCESS;
> 
>@@ -1242,6 +1299,10 @@
>             idata.flags |= PAMNS_IGN_CONFIG_ERR;
>         if (strcmp(argv[i], "ignore_instance_parent_mode") == 0)
>             idata.flags |= PAMNS_IGN_INST_PARENT_MODE;
>+        if (strcmp(argv[i], "user_default_context_fallback") == 0)
>+            idata.flags |= PAMNS_USER_DEFAULT_CONTEXT_FALLBACK;
>+        if (strcmp(argv[i], "su_getcon") == 0)
>+            idata.flags |= PAMNS_SU_GETCON;
>         if (strcmp(argv[i], "unmnt_remnt") == 0)
>             unmnt = UNMNT_REMNT;
>         if (strcmp(argv[i], "unmnt_only") == 0)
>--- Linux-PAM-0.99.7.0/modules/pam_namespace/pam_namespace.h	2007-04-26 16:00:14.000000000 -0500
>+++ Linux-PAM-0.99.7.0.new/modules/pam_namespace/pam_namespace.h	2007-04-25 13:54:52.000000000 -0500
>@@ -88,6 +88,8 @@
> #define PAMNS_IGN_CONFIG_ERR  0x00004000 /* Ignore format error in conf file */
> #define PAMNS_IGN_INST_PARENT_MODE  0x00008000 /* Ignore instance parent mode */
> #define PAMNS_NO_UNMOUNT_ON_CLOSE  0x00010000 /* no unmount at session close */
>+#define PAMNS_USER_DEFAULT_CONTEXT_FALLBACK 0x00020000 /* if getexeccon fails use user default context */
>+#define PAMNS_SU_GETCON  0x00040000 /* if called from 'su' use getcon for context */
> 
> /*
>  * Polyinstantiation method options, based on user, security context
>--- Linux-PAM-0.99.7.0/modules/pam_namespace/pam_namespace.8.xml	2007-04-26 16:00:14.000000000 -0500
>+++ Linux-PAM-0.99.7.0.new/modules/pam_namespace/pam_namespace.8.xml	2007-04-26 09:49:54.000000000 -0500
>@@ -46,6 +46,12 @@
>       <arg choice="opt">
>         no_unmount_on_close
>       </arg>
>+      <arg choice="opt">
>+        su_getcon
>+      </arg>
>+      <arg choice="opt">
>+        user_default_context_fallback
>+      </arg>
>     </cmdsynopsis>
>   </refsynopsisdiv>
> 
>@@ -198,6 +204,37 @@
>         </listitem>
>       </varlistentry>
> 
>+      <varlistentry>
>+        <term>
>+          <option>su_getcon</option>
>+        </term>
>+        <listitem>
>+          <para>
>+	   When using su enabling this option causes pam to use the parent
>+	   processes context for the polyinstantiated directories. This 
>+	   option only affects the context and level polyinstantiation 
>+	   methods.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>+
>+      <varlistentry>
>+        <term>
>+          <option>user_default_context_fallback</option>
>+        </term>
>+        <listitem>
>+          <para>
>+	   If setexeccon has not been called by the calling process
>+	   enabling this option causes pam to use the users default
>+	   context for the polyinstantiated directories. For example
>+	   gdm does not call setexeccon prior to opening the pam session
>+	   so without setting this option no context or level based 
>+	   polyinstantiation will occur. This option only affects the
>+	   context and level polyinstantiation methods.
>+          </para>
>+        </listitem>
>+      </varlistentry>
>+
>     </variablelist>
>   </refsect1>
>

Actions: View | Diff

Attachments on bug 237876: 153655