Attachment 891391 Details for Bug 1091761 – possible seunshare fix

[patch] possible seunshare fix

0001-seunshare-Try-to-use-setcurrent-before-setexec.patch (text/plain), 1.97 KB, created by Andy Lutomirski on 2014-05-01 05:03:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andy Lutomirski

Created: 2014-05-01 05:03:29 UTC

Size: 1.97 KB

patch

obsolete

>From efc2a7842457a4eda1a9f1e7f9d902609f6fb834 Mon Sep 17 00:00:00 2001
>Message-Id: <efc2a7842457a4eda1a9f1e7f9d902609f6fb834.1398920499.git.luto@amacapital.net>
>From: Andy Lutomirski <luto@amacapital.net>
>Date: Wed, 30 Apr 2014 21:59:37 -0700
>Subject: [PATCH] seunshare: Try to use setcurrent before setexec
>
>If seunshare uses PR_SET_NO_NEW_PRIVS, which certain versions of
>libcap-ng set, setexeccon will cause execve to fail.
>
>Note that this won't work without adjusting the system policy to
>allow this use of setcurrent.
>
>Signed-off-by: Andy Lutomirski <luto@amacapital.net>
>---
> policycoreutils/sandbox/sandbox     |  2 +-
> policycoreutils/sandbox/seunshare.c | 13 ++++++++++---
> 2 files changed, 11 insertions(+), 4 deletions(-)
>
>diff --git a/policycoreutils/sandbox/sandbox b/policycoreutils/sandbox/sandbox
>index 3668abe..031d4a2 100644
>--- a/policycoreutils/sandbox/sandbox
>+++ b/policycoreutils/sandbox/sandbox
>@@ -29,7 +29,7 @@ import commands
> import sepolicy
> 
> PROGNAME = "policycoreutils"
>-SEUNSHARE = "/usr/sbin/seunshare"
>+SEUNSHARE = "./seunshare"
> SANDBOXSH = "/usr/share/sandbox/sandboxX.sh"
> import gettext
> gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
>diff --git a/policycoreutils/sandbox/seunshare.c b/policycoreutils/sandbox/seunshare.c
>index 97f3920..f154d71 100644
>--- a/policycoreutils/sandbox/seunshare.c
>+++ b/policycoreutils/sandbox/seunshare.c
>@@ -1033,9 +1033,16 @@ int main(int argc, char **argv) {
> 		}
> 
> 		/* selinux context */
>-		if (execcon && setexeccon(execcon) != 0) {
>-			fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
>-			goto childerr;
>+		if (execcon) {
>+			/* try dyntransition, since no_new_privs can interfere
>+			 * with setexeccon */
>+			if (setcon(execcon) != 0) {
>+				/* failed; fall back to setexeccon */
>+				if (setexeccon(execcon) != 0) {
>+					fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
>+					goto childerr;
>+				}
>+			}
> 		}
> 
> 		if (chdir(pwd->pw_dir)) {
>-- 
>1.9.0
>

Actions: View | Diff

Attachments on bug 1091761: 891391 | 891393