Attachment 834057 Details for Bug 1022762 – [PATCH v2] selinux: Check access vector for enable and disable perm for each unit file

[PATCH v2] selinux: Check access vector for enable and disable perm for each unit file

0001-selinux-Check-access-vector-for-enable-and-disable-p.patch (text/plain), 1.69 KB, created by Lubomir Rintel on 2013-12-08 12:43:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Rintel

Created: 2013-12-08 12:43:42 UTC

Size: 1.69 KB

patch

obsolete

>From 4b7699f1f7c94d4344c228e87c0bea1d63cca170 Mon Sep 17 00:00:00 2001
>From: Lubomir Rintel <lkundrak@v3.sk>
>Date: Fri, 6 Dec 2013 14:05:49 +0100
>Subject: [PATCH v2] selinux: Check access vector for enable and disable perm for
> each unit file
>
>---
>Changes in v2:
>  - Made conditional for HAVE_SELINUX
>  - Rebased against git tip
>  - Don't generate access vector checks for nonexistent units
>
> src/core/dbus-manager.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
>
>diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
>index a2707ee..1a7432f 100644
>--- a/src/core/dbus-manager.c
>+++ b/src/core/dbus-manager.c
>@@ -1405,6 +1405,7 @@ static int method_enable_unit_files_generic(
>                 sd_bus_error *error) {
> 
>         _cleanup_strv_free_ char **l = NULL;
>+        char **i;
>         UnitFileChange *changes = NULL;
>         unsigned n_changes = 0;
>         UnitFileScope scope;
>@@ -1414,14 +1415,23 @@ static int method_enable_unit_files_generic(
>         assert(message);
>         assert(m);
> 
>-        r = selinux_access_check(bus, message, verb, error);
>-        if (r < 0)
>-                return r;
>-
>         r = sd_bus_message_read_strv(message, &l);
>         if (r < 0)
>                 return r;
> 
>+#ifdef HAVE_SELINUX
>+        STRV_FOREACH(i, l) {
>+                Unit *u;
>+
>+                u = manager_get_unit(m, *i);
>+                if (u) {
>+                        r = selinux_unit_access_check(u, bus, message, verb, error);
>+                        if (r < 0)
>+                                return r;
>+                }
>+        }
>+#endif
>+
>         r = sd_bus_message_read(message, "bb", &runtime, &force);
>         if (r < 0)
>                 return r;
>-- 
>1.8.4.2
>

Actions: View

Attachments on bug 1022762: 815594 | 829782 | 834057