Attachment 576630 Details for Bug 517170 – Initial patch.

[patch] Initial patch.

fcron-selinux-fix.patch (text/plain), 1.47 KB, created by Tim Landscheidt on 2012-04-10 23:21:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tim Landscheidt

Created: 2012-04-10 23:21:22 UTC

Size: 1.47 KB

patch

obsolete

>--- fcron-3.0.6.orig/conf.c	2012-04-10 14:18:13.936717984 +0000
>+++ fcron-3.0.6/conf.c	2012-04-10 23:00:27.240489218 +0000
>@@ -444,7 +444,6 @@
>     int flask_enabled = is_selinux_enabled();
>     int retval;
>     struct av_decision avd;
>-    const char *user_name;
> #endif
> 
>     /* open file */
>@@ -507,16 +506,27 @@
>      * the user cron job.  It performs an entrypoint
>      * permission check for this purpose.
>      */
>-#ifdef SYSFCRONTAB
>-    if(!strcmp(cf->cf_user, SYSFCRONTAB))
>-	user_name = "system_u";
>-    else
>-#endif /* def SYSFCRONTAB */
>-	user_name = cf->cf_user;
>     if(flask_enabled)
>     {
>+	char *user_name;
>+
>+#ifdef SYSFCRONTAB
>+	if(!strcmp(cf->cf_user, SYSFCRONTAB))
>+	  user_name = "system_u";
>+	else
>+#endif /* def SYSFCRONTAB */
>+	{
>+	    char *level;	  /* ignored */
>+
>+	    if (getseuserbyname(cf->cf_user, &user_name, &level))
>+	      error_e("getseuserbyname(\"%s\") failed", cf->cf_user);
>+	    else
>+	      free (level);
>+	}
>+
>+	/* TODO: Why not get_default_context_with_level()? */
> 	if(get_default_context(user_name, NULL, &cf->cf_user_context))
>-	    error_e("NO CONTEXT for user \"%s\"", cf->cf_user_context);
>+	    error_e("NO CONTEXT for user \"%s\"", user_name);
> 	retval = security_compute_av(cf->cf_user_context, cf->cf_file_context
> 		, SECCLASS_FILE, FILE__ENTRYPOINT, &avd);
> 
>@@ -527,6 +537,7 @@
> 		   , cf->cf_user, cf->cf_user_context, cf->cf_file_context);
> 	    goto err;
> 	}
>+      /* FIXME: free() user_name when not set by SYSFCRONTAB */
>     }
> #endif
>

Actions: View | Diff

Attachments on bug 517170: 576630