Set correct SELinux context of daemon started from the pam module (#684225)
This commit is contained in:
Tomas Bzatek
parent
130b1ec61d
commit
dd74952191
|
|
@ -0,0 +1,93 @@
|
|||
diff --git a/configure.in b/configure.in
|
||||
index a5a434d..8294028 100644
|
||||
--- a/configure.in
|
||||
+++ b/configure.in
|
||||
@@ -572,6 +572,28 @@ AC_SUBST(GCOV)
|
||||
AC_SUBST(GENHTML)
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
+# selinux
|
||||
+AC_ARG_ENABLE([selinux],
|
||||
+ AC_HELP_STRING([--disable-selinux],[do not use SELinux]),
|
||||
+ WITH_SELINUX=$enableval, WITH_SELINUX=yes)
|
||||
+if test "$WITH_SELINUX" == "yes" ; then
|
||||
+ AC_CHECK_LIB([selinux],[getfilecon], LIBSELINUX="-lselinux", LIBSELINUX="")
|
||||
+ selinux_status="yes"
|
||||
+else
|
||||
+ LIBSELINUX=""
|
||||
+ selinux_status="no"
|
||||
+fi
|
||||
+AC_SUBST(LIBSELINUX)
|
||||
+AM_CONDITIONAL([HAVE_LIBSELINUX], [test ! -z "$LIBSELINUX"])
|
||||
+if test ! -z "$LIBSELINUX" ; then
|
||||
+ AC_DEFINE([WITH_SELINUX], 1, [Defined if SE Linux support is compiled in])
|
||||
+ BACKUP_LIBS=$LIBS
|
||||
+ LIBS="$LIBS $LIBSELINUX"
|
||||
+ AC_CHECK_FUNCS(setexeccon)
|
||||
+ LIBS=$BACKUP_LIBS
|
||||
+fi
|
||||
+
|
||||
+# ----------------------------------------------------------------------
|
||||
# Valgrind
|
||||
|
||||
AC_ARG_ENABLE(valgrind,
|
||||
@@ -742,6 +764,7 @@ echo
|
||||
echo "OPTIONAL DEPENDENCIES"
|
||||
echo " PAM: $pam_status"
|
||||
echo " Linux capabilities: $libcapng_status"
|
||||
+echo " SELinux: $selinux_status"
|
||||
echo
|
||||
echo "CONFIGURATION"
|
||||
echo " SSH Agent: $ssh_status"
|
||||
diff --git a/pam/gkr-pam-module.c b/pam/gkr-pam-module.c
|
||||
index e63c917..2e2e765 100644
|
||||
--- a/pam/gkr-pam-module.c
|
||||
+++ b/pam/gkr-pam-module.c
|
||||
@@ -317,6 +317,36 @@ cleanup_free_password (pam_handle_t *ph, void *data, int pam_end_status)
|
||||
free_password (data);
|
||||
}
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+#include <selinux/flask.h>
|
||||
+#include <selinux/selinux.h>
|
||||
+/* Attempt to set SELinux Context. We are ignoring failure and just going
|
||||
+ with default behaviour default behaviour
|
||||
+*/
|
||||
+static void setup_selinux_context(const char *command) {
|
||||
+ security_context_t fcon = NULL, newcon = NULL, execcon = NULL;
|
||||
+
|
||||
+ if (is_selinux_enabled() != 1) return;
|
||||
+
|
||||
+ int ret = getexeccon(&execcon);
|
||||
+ if ((ret < 0) || (! execcon)) goto err;
|
||||
+
|
||||
+ ret = getfilecon(command, &fcon);
|
||||
+ if (ret < 0) goto err;
|
||||
+
|
||||
+ ret = security_compute_create(execcon, fcon, SECCLASS_PROCESS, &newcon);
|
||||
+ if (ret < 0) goto err;
|
||||
+
|
||||
+ setexeccon(newcon);
|
||||
+
|
||||
+err:
|
||||
+ freecon(newcon);
|
||||
+ freecon(fcon);
|
||||
+ freecon(execcon);
|
||||
+ return;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
static void
|
||||
setup_child (int inp[2], int outp[2], int errp[2], pam_handle_t *ph, struct passwd *pwd)
|
||||
{
|
||||
@@ -329,6 +359,10 @@ setup_child (int inp[2], int outp[2], int errp[2], pam_handle_t *ph, struct pass
|
||||
char *args[] = { GNOME_KEYRING_DAEMON, "--daemonize", "--login", NULL};
|
||||
#endif
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ setup_selinux_context(GNOME_KEYRING_DAEMON);
|
||||
+#endif
|
||||
+
|
||||
assert (pwd);
|
||||
assert (pwd->pw_dir);
|
||||
|
||||
|
|
@ -3,11 +3,12 @@
|
|||
%define dbus_version 1.0
|
||||
%define gcrypt_version 1.2.2
|
||||
%define libtasn1_version 0.3.4
|
||||
%define libgnome-keyring_version 2.91.92
|
||||
|
||||
Summary: Framework for managing passwords and other secrets
|
||||
Name: gnome-keyring
|
||||
Version: 2.91.92
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2+ and LGPLv2+
|
||||
Group: System Environment/Libraries
|
||||
#VCS: git:git://git.gnome.org/gnome-keyring
|
||||
|
|
@ -18,6 +19,10 @@ URL: http://www.gnome.org
|
|||
# https://bugzilla.redhat.com/show_bug.cgi?id=668831
|
||||
Patch4: file-caps.patch
|
||||
|
||||
# gnome keyring pam module is starting gnome-keyring with the wrong SELinux context.
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=684225
|
||||
Patch5: gnome-keyring-2.91.93-pam-selinux.patch
|
||||
|
||||
BuildRequires: glib2-devel >= %{glib2_version}
|
||||
BuildRequires: gtk3-devel >= %{gtk3_version}
|
||||
BuildRequires: dbus-devel >= %{dbus_version}
|
||||
|
|
@ -28,11 +33,11 @@ BuildRequires: autoconf, automake, libtool
|
|||
BuildRequires: gettext
|
||||
BuildRequires: intltool
|
||||
BuildRequires: libtasn1-tools
|
||||
BuildRequires: libgnome-keyring-devel
|
||||
BuildRequires: libgnome-keyring-devel >= %{libgnome-keyring_version}
|
||||
BuildRequires: gtk-doc
|
||||
BuildRequires: libcap-ng-devel
|
||||
# for smooth transition since the core was split
|
||||
Requires: libgnome-keyring
|
||||
Requires: libgnome-keyring >= %{libgnome-keyring_version}
|
||||
|
||||
%description
|
||||
The gnome-keyring session daemon manages passwords and other types of
|
||||
|
|
@ -68,6 +73,7 @@ automatically unlock the "login" keyring when the user logs in.
|
|||
%prep
|
||||
%setup -q -n gnome-keyring-%{version}
|
||||
%patch4 -p1 -b .file-caps
|
||||
%patch5 -p1 -b .pam-selinux
|
||||
|
||||
%build
|
||||
autoreconf -i -f
|
||||
|
|
@ -142,6 +148,9 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas
|
|||
|
||||
|
||||
%changelog
|
||||
* Tue Mar 15 2011 Tomas Bzatek <tbzatek@redhat.com> - 2.91.92-2
|
||||
- Set correct SELinux context of daemon started from the pam module (#684225)
|
||||
|
||||
* Fri Mar 11 2011 Tomas Bzatek <tbzatek@redhat.com> - 2.91.92-1
|
||||
- Update to 2.91.92
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue