Attachment 297260 Details for Bug 436564 – patch to set SO_PEERCRED based on arch

[patch] patch to set SO_PEERCRED based on arch

setroubleshoot-get_credentials.patch (text/plain), 2.94 KB, created by John Dennis on 2008-03-07 22:46:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John Dennis

Created: 2008-03-07 22:46:14 UTC

Size: 2.94 KB

patch

obsolete

>--- setroubleshoot-2.0.5/src/access_control.py.get_credentials	2008-01-07 09:31:57.000000000 -0500
>+++ setroubleshoot-2.0.5/src/access_control.py	2008-03-07 16:14:02.000000000 -0500
>@@ -21,6 +21,8 @@
> determining which users are allowed to connect to the server: see
> UserServerAccess for more information."""
> 
>+import os
>+import re
> import struct
> import socket as Socket
> 
>@@ -32,6 +34,25 @@
>     'ServerAccess',
>     ]
>            
>+# SO_PEERCRED is not defined by the socket class unless patched
>+# SO_PEERCRED's value is architecture dependent
>+# alpha, mips:    18
>+# parisc:         0x4011
>+# powerpc:        21
>+# sparc, sparc64: 0x0040
>+# default:        17
>+try:
>+    SO_PEERCRED = Socket.SO_PEERCRED
>+except AttributeError:
>+    machine = os.uname()[4]
>+    if   re.search(r'^i\d86',           machine): SO_PEERCRED = 17     # i386,i486,i586,i686, etc.
>+    elif re.search(r'^x86_64)',         machine): SO_PEERCRED = 17     # x86_64
>+    elif re.search(r'^(ppc|powerpc)',   machine): SO_PEERCRED = 21     # ppc
>+    elif re.search(r'^(alpha|mips)',    machine): SO_PEERCRED = 18     # alpha, mips
>+    elif re.search(r'^sparc',           machine): SO_PEERCRED = 0x0040 # sparc
>+    elif re.search(r'^parisc',          machine): SO_PEERCRED = 0x4011 # parisc
>+    else: SO_PEERCRED = 17 
>+    #print "hardcoding SO_PEERCRED=%s" % SO_PEERCRED
> 
> class ServerAccess:
>     """
>@@ -106,20 +127,34 @@
> 
>         return self.user_allowed(privilege, pwd_entry[0])
> 
>-    def get_credentials(self, conn):
>+    def get_credentials(self, sock):
>         """Obtain the effective user and group IDs of the process on
>         the other end of a socket. SO_PEERCRED is used so the information
>         returned is generally trustworthy (though root processes can
>         impersonate any uid/gid)."""
>         
>-        # This is not defined by the socket class, so we must define
>-        # it here.
>-        SO_PEERCRED = 17
>-        sizeof_ucred = 12
>+        pid = uid = gid = None
>+        try:
>+            # socket attributes family,type,proto,timeout available only in Python >= 2.5
>+            family = sock.family
>+            if family != socket.AF_UNIX:
>+                return uid, gid
>+        except AttributeError:
>+            # rely on pid,uid,gid being -1 if family is not AF_UNIX
>+            pass
>+
>         format_ucred = 'III' # pid_t, uid_t, gid_t
>-        
>-        ucred = conn.getsockopt(Socket.SOL_SOCKET, SO_PEERCRED, sizeof_ucred)
>-        pid, uid, gid = struct.unpack(format_ucred, ucred)
>+        sizeof_ucred = struct.calcsize(format_ucred)
>+
>+        try:
>+            ucred = sock.getsockopt(socket.SOL_SOCKET, SO_PEERCRED, sizeof_ucred)
>+            pid, uid, gid = struct.unpack(format_ucred, ucred)
>+            if pid == -1: pid = None
>+            if uid == -1: uid = None
>+            if gid == -1: gid = None
>+        except Exception, e:
>+            pid = uid = gid = None
>+            log_program.error("get_credentials(): %s", e)
> 
>         return uid, gid
>

Actions: View | Diff

Attachments on bug 436564: 297260