Attachment 829782 Details for Bug 1022762 – Proposed fix

Proposed fix

0001-selinux-Check-access-vector-for-enable-and-disable-p.patch (text/plain), 4.10 KB, created by Lubomir Rintel on 2013-11-27 15:44:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Rintel

Created: 2013-11-27 15:44:30 UTC

Size: 4.10 KB

patch

obsolete

>From 83a3934a074a1dcbad934c4f20795e2f91dcf483 Mon Sep 17 00:00:00 2001
>From: Fedora systemd team <systemd-maint@redhat.com>
>Date: Wed, 27 Nov 2013 15:53:59 +0100
>Subject: [PATCH] selinux: Check access vector for enable and disable perm for
> each unit file
>
>---
> src/core/dbus-manager.c | 28 ++++++++++++++++++++++++----
> 1 file changed, 24 insertions(+), 4 deletions(-)
>
>diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
>index 536f2ea..ab5080e 100644
>--- a/src/core/dbus-manager.c
>+++ b/src/core/dbus-manager.c
>@@ -1581,6 +1581,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                    dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "SetDefaultTarget")) {
> 
>                 char **l = NULL;
>+                char **i;
>                 DBusMessageIter iter;
>                 UnitFileScope scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
>                 UnitFileChange *changes = NULL;
>@@ -1588,8 +1589,6 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                 dbus_bool_t runtime, force;
>                 int carries_install_info = -1;
> 
>-                SELINUX_ACCESS_CHECK(connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
>-
>                 if (!dbus_message_iter_init(message, &iter))
>                         goto oom;
> 
>@@ -1601,6 +1600,17 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                         return bus_send_error_reply(connection, message, NULL, r);
>                 }
> 
>+                STRV_FOREACH(i, l) {
>+                        Unit *u;
>+
>+                        u = manager_get_unit(m, *i);
>+                        if (!u) {
>+                                dbus_set_error(&error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", *i);
>+                                return bus_send_error_reply(connection, message, &error, -ENOENT);
>+                        }
>+                        SELINUX_UNIT_ACCESS_CHECK(u, connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
>+                }
>+
>                 if (!dbus_message_iter_next(&iter) ||
>                     bus_iter_get_basic_and_next(&iter, DBUS_TYPE_BOOLEAN, &runtime, true) < 0 ||
>                     bus_iter_get_basic_and_next(&iter, DBUS_TYPE_BOOLEAN, &force, false) < 0) {
>@@ -1644,14 +1654,13 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                    dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "UnmaskUnitFiles")) {
> 
>                 char **l = NULL;
>+                char **i;
>                 DBusMessageIter iter;
>                 UnitFileScope scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
>                 UnitFileChange *changes = NULL;
>                 unsigned n_changes = 0;
>                 dbus_bool_t runtime;
> 
>-                SELINUX_ACCESS_CHECK(connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
>-
>                 if (!dbus_message_iter_init(message, &iter))
>                         goto oom;
> 
>@@ -1669,6 +1678,17 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                         return bus_send_error_reply(connection, message, NULL, -EIO);
>                 }
> 
>+                STRV_FOREACH(i, l) {
>+                        Unit *u;
>+
>+                        u = manager_get_unit(m, *i);
>+                        if (!u) {
>+                                dbus_set_error(&error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", *i);
>+                                return bus_send_error_reply(connection, message, &error, -ENOENT);
>+                        }
>+                        SELINUX_UNIT_ACCESS_CHECK(u, connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
>+                }
>+
>                 if (streq(member, "DisableUnitFiles"))
>                         r = unit_file_disable(scope, runtime, NULL, l, &changes, &n_changes);
>                 else if (streq(member, "UnmaskUnitFiles"))
>-- 
>1.8.4.2
>

Actions: View

Attachments on bug 1022762: 815594 | 829782 | 834057