emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

* NEWS, src/userdel.c, man/userdel.8.xml: Add option -Z/--selinux-user.

Browse Source 
* libmisc/system.c, lib/prototypes.h, libmisc/Makefile.am: Removed
	safe_system().
	* lib/selinux.c, po/POTFILES.in, lib/prototypes.h,
	lib/Makefile.am: Added helper functions for semanage.
	* README, src/useradd.c, src/usermod.c, src/userdel.c,
	configure.in: Use libsemanage instead of semanage.
This commit is contained in:
nekral-guest
2011-11-17 21:51:07 +00:00
parent f3ef11056f
commit 29050eadb5
15 changed files with 519 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Makefile.am
View File

@@ -106,9 +106,9 @@ su_SOURCES = \
suauth.c
su_LDADD = $(LDADD) $(LIBPAM) $(LIBCRYPT_NOPAM) $(LIBSKEY) $(LIBMD)
sulogin_LDADD = $(LDADD) $(LIBCRYPT)
useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBACL) $(LIBATTR)
userdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX)
usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBACL) $(LIBATTR)
useradd_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
userdel_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE)
usermod_LDADD = $(LDADD) $(LIBPAM_SUID) $(LIBAUDIT) $(LIBSELINUX) $(LIBSEMANAGE) $(LIBACL) $(LIBATTR)
vipw_LDADD = $(LDADD) $(LIBSELINUX)
install-am: all-am

62
src/useradd.c
View File

@@ -112,7 +112,7 @@ static const char *user_shell = "";
static const char *create_mail_spool = "";
#ifdef WITH_SELINUX
static const char *user_selinux = "";
#endif
#endif /* WITH_SELINUX */
static long user_expire = -1;
static bool is_shadow_pwd;
@@ -145,6 +145,9 @@ static bool
oflg = false, /* permit non-unique user ID to be specified with -u */
rflg = false, /* create a system account */
sflg = false, /* shell program for new account */
#ifdef WITH_SELINUX
Zflg = false, /* new selinux user */
#endif /* WITH_SELINUX */
uflg = false, /* specify user ID for new account */
Uflg = false; /* create a group having the same name as the user */
@@ -164,6 +167,7 @@ static bool home_added = false;
#define E_GRP_UPDATE 10 /* can't update group file */
#define E_HOMEDIR 12 /* can't create home directory */
#define E_MAIL_SPOOL 13 /* can't create mail spool */
#define E_SE_UPDATE 14 /* can't update SELinux user mapping */
#define DGROUP "GROUP="
#define DHOME "HOME="
@@ -181,9 +185,6 @@ static int set_defaults (void);
static int get_groups (char *);
static void usage (int status);
static void new_pwent (struct passwd *);
#ifdef WITH_SELINUX
static void selinux_update_mapping (void);
#endif
static long scale_age (long);
static void new_spent (struct spwd *);
@@ -730,7 +731,7 @@ static void usage (int status)
(void) fputs (_(" -U, --user-group create a group with the same name as the user\n"), usageout);
#ifdef WITH_SELINUX
(void) fputs (_(" -Z, --selinux-user SEUSER use a specific SEUSER for the SELinux user mapping\n"), usageout);
#endif
#endif /* WITH_SELINUX */
(void) fputs ("\n", usageout);
exit (status);
}
@@ -1004,15 +1005,15 @@ static void process_flags (int argc, char **argv)
{"user-group", no_argument, NULL, 'U'},
#ifdef WITH_SELINUX
{"selinux-user", required_argument, NULL, 'Z'},
#endif
#endif /* WITH_SELINUX */
{NULL, 0, NULL, '\0'}
};
while ((c = getopt_long (argc, argv,
#ifdef WITH_SELINUX
"b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:UZ:",
#else
#else /* !WITH_SELINUX */
"b:c:d:De:f:g:G:hk:K:lmMNop:rR:s:u:U",
#endif
#endif /* !WITH_SELINUX */
long_options, NULL)) != -1) {
switch (c) {
case 'b':
@@ -1213,6 +1214,7 @@ static void process_flags (int argc, char **argv)
case 'Z':
if (is_selinux_enabled () > 0) {
user_selinux = optarg;
Zflg = true;
} else {
fprintf (stderr,
_("%s: -Z requires SELinux enabled kernel\n"),
@@ -1221,7 +1223,7 @@ static void process_flags (int argc, char **argv)
exit (E_BAD_ARG);
}
break;
#endif
#endif /* WITH_SELINUX */
default:
usage (E_USAGE);
}
@@ -1745,32 +1747,6 @@ static void usr_update (void)
}
}
#ifdef WITH_SELINUX
static void selinux_update_mapping (void) {
if (is_selinux_enabled () <= 0) return;
if ('\0' != *user_selinux) { /* must be done after passwd write() */
const char *argv[7];
argv[0] = "/usr/sbin/semanage";
argv[1] = "login";
argv[2] = "-a";
argv[3] = "-s";
argv[4] = user_selinux;
argv[5] = user_name;
argv[6] = NULL;
if (safe_system (argv[0], argv, NULL, false) != 0) {
fprintf (stderr,
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
Prog, user_name, user_selinux);
#ifdef WITH_AUDIT
audit_logger (AUDIT_ADD_USER, Prog,
"adding SELinux user mapping",
user_name, (unsigned int) user_id, 0);
#endif
}
}
}
#endif
/*
* create_home - create the user's home directory
*
@@ -2082,8 +2058,20 @@ int main (int argc, char **argv)
close_files ();
#ifdef WITH_SELINUX
selinux_update_mapping ();
#endif
if (Zflg && ('\0' != *user_selinux)) {
if (set_seuser (user_name, user_selinux) != 0) {
fprintf (stderr,
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
Prog, user_name, user_selinux);
#ifdef WITH_AUDIT
audit_logger (AUDIT_ADD_USER, Prog,
"adding SELinux user mapping",
user_name, (unsigned int) user_id, 0);
#endif /* WITH_AUDIT */
fail_exit (E_SE_UPDATE);
}
}
#endif /* WITH_SELINUX */
nscd_flush_cache ("passwd");
nscd_flush_cache ("group");

56
src/userdel.c
View File

@@ -74,6 +74,7 @@
#define E_USER_BUSY 8 /* user currently logged in */
#define E_GRP_UPDATE 10 /* can't update group file */
#define E_HOMEDIR 12 /* can't remove home directory */
#define E_SE_UPDATE 14 /* can't update SELinux user mapping */
/*
* Global variables
@@ -87,6 +88,7 @@ static char *user_home;
static bool fflg = false;
static bool rflg = false;
static bool Zflg = false;
static bool is_shadow_pwd;
@@ -134,6 +136,9 @@ static void usage (int status)
(void) fputs (_(" -h, --help display this help message and exit\n"), usageout);
(void) fputs (_(" -r, --remove remove home directory and mail spool\n"), usageout);
(void) fputs (_(" -R, --root CHROOT_DIR directory to chroot into\n"), usageout);
#ifdef WITH_SELINUX
(void) fputs (_(" -Z, --selinux-user remove any SELinux user mapping for the user\n"), usageout);
#endif /* WITH_SELINUX */
(void) fputs ("\n", usageout);
exit (status);
}
@@ -870,13 +875,21 @@ int main (int argc, char **argv)
*/
int c;
static struct option long_options[] = {
{"force", no_argument, NULL, 'f'},
{"help", no_argument, NULL, 'h'},
{"remove", no_argument, NULL, 'r'},
{"root", required_argument, NULL, 'R'},
{"force", no_argument, NULL, 'f'},
{"help", no_argument, NULL, 'h'},
{"remove", no_argument, NULL, 'r'},
{"root", required_argument, NULL, 'R'},
#ifdef WITH_SELINUX
{"selinux-user", no_argument, NULL, 'Z'},
#endif /* WITH_SELINUX */
{NULL, 0, NULL, '\0'}
};
while ((c = getopt_long (argc, argv, "fhrR:",
while ((c = getopt_long (argc, argv,
#ifdef WITH_SELINUX
"fhrR:Z",
#else /* !WITH_SELINUX */
"fhrR:",
#endif /* !WITH_SELINUX */
long_options, NULL)) != -1) {
switch (c) {
case 'f': /* force remove even if not owned by user */
@@ -890,6 +903,19 @@ int main (int argc, char **argv)
break;
case 'R': /* no-op, handled in process_root_flag () */
break;
#ifdef WITH_SELINUX
case 'Z':
if (is_selinux_enabled () > 0) {
Zflg = true;
} else {
fprintf (stderr,
_("%s: -Z requires SELinux enabled kernel\n"),
Prog);
exit (E_BAD_ARG);
}
break;
#endif /* WITH_SELINUX */
default:
usage (E_USAGE);
}
@@ -1091,14 +1117,18 @@ int main (int argc, char **argv)
#endif /* WITH_AUDIT */
#ifdef WITH_SELINUX
if (is_selinux_enabled () > 0) {
const char *args[5];
args[0] = "/usr/sbin/semanage";
args[1] = "login";
args[2] = "-d";
args[3] = user_name;
args[4] = NULL;
safe_system (args[0], args, NULL, true);
if (Zflg) {
if (del_seuser (user_name) != 0) {
fprintf (stderr,
_("%s: warning: the user name %s to SELinux user mapping removal failed.\n"),
Prog, user_name);
#ifdef WITH_AUDIT
audit_logger (AUDIT_ADD_USER, Prog,
"removing SELinux user mapping",
user_name, (unsigned int) user_id, 0);
#endif /* WITH_AUDIT */
fail_exit (E_SE_UPDATE);
}
}
#endif /* WITH_SELINUX */

72
src/usermod.c
View File

@@ -85,6 +85,7 @@
#define E_GRP_UPDATE 10 /* can't update group file */
/* #define E_NOSPACE 11 insufficient space to move home dir */
#define E_HOMEDIR 12 /* unable to complete home dir move */
#define E_SE_UPDATE 13 /* can't update SELinux user mapping */
#define VALID(s) (strcspn (s, ":\n") == strlen (s))
/*
* Global variables
@@ -105,7 +106,7 @@ static char *user_newhome;
static char *user_shell;
#ifdef WITH_SELINUX
static const char *user_selinux = "";
#endif
#endif /* WITH_SELINUX */
static char *user_newshell;
static long user_expire;
static long user_newexpire;
@@ -154,10 +155,6 @@ static void date_to_str (/*@unique@*//*@out@*/char *buf, size_t maxsize,
static int get_groups (char *);
static /*@noreturn@*/void usage (int status);
static void new_pwent (struct passwd *);
#ifdef WITH_SELINUX
static void selinux_update_mapping (void);
#endif
static void new_spent (struct spwd *);
static /*@noreturn@*/void fail_exit (int);
static void update_group (void);
@@ -338,8 +335,8 @@ static /*@noreturn@*/void usage (int status)
(void) fputs (_(" -u, --uid UID new UID for the user account\n"), usageout);
(void) fputs (_(" -U, --unlock unlock the user account\n"), usageout);
#ifdef WITH_SELINUX
(void) fputs (_(" -Z, --selinux-user new SELinux user mapping for the user account\n"), usageout);
#endif
(void) fputs (_(" -Z, --selinux-user SEUSER new SELinux user mapping for the user account\n"), usageout);
#endif /* WITH_SELINUX */
(void) fputs ("\n", usageout);
exit (status);
}
@@ -894,15 +891,15 @@ static void process_flags (int argc, char **argv)
{"unlock", no_argument, NULL, 'U'},
#ifdef WITH_SELINUX
{"selinux-user", required_argument, NULL, 'Z'},
#endif
#endif /* WITH_SELINUX */
{NULL, 0, NULL, '\0'}
};
while ((c = getopt_long (argc, argv,
#ifdef WITH_SELINUX
"ac:d:e:f:g:G:hl:Lmop:R:s:u:UZ:",
#else
#else /* !WITH_SELINUX */
"ac:d:e:f:g:G:hl:Lmop:R:s:u:U",
#endif
#endif /* !WITH_SELINUX */
long_options, NULL)) != -1) {
switch (c) {
case 'a':
@@ -1033,7 +1030,7 @@ static void process_flags (int argc, char **argv)
exit (E_BAD_ARG);
}
break;
#endif
#endif /* WITH_SELINUX */
default:
usage (E_USAGE);
}
@@ -1175,7 +1172,7 @@ static void process_flags (int argc, char **argv)
lflg || Gflg || gflg || fflg || eflg || dflg || cflg
#ifdef WITH_SELINUX
|| Zflg
#endif
#endif /* WITH_SELINUX */
)) {
fprintf (stderr, _("%s: no changes\n"), Prog);
exit (E_SUCCESS);
@@ -1893,10 +1890,20 @@ int main (int argc, char **argv)
nscd_flush_cache ("group");
#ifdef WITH_SELINUX
if (Zflg) {
selinux_update_mapping ();
if (Zflg && *user_selinux) {
if (set_seuser (user_name, user_selinux) != 0) {
fprintf (stderr,
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
Prog, user_name, user_selinux);
#ifdef WITH_AUDIT
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
"modifying User mapping ",
user_name, (unsigned int) user_id, 0);
#endif /* WITH_AUDIT */
fail_exit (E_SE_UPDATE);
}
}
#endif
#endif /* WITH_SELINUX */
if (mflg) {
move_home ();
@@ -1906,7 +1913,7 @@ int main (int argc, char **argv)
if (lflg || uflg) {
move_mailbox ();
}
#endif
#endif /* NO_MOVE_MAILBOX */
if (uflg) {
update_lastlog ();
@@ -1940,36 +1947,3 @@ int main (int argc, char **argv)
return E_SUCCESS;
}
#ifdef WITH_SELINUX
static void selinux_update_mapping (void) {
const char *argv[7];
if (is_selinux_enabled () <= 0) {
return;
}
if ('\0' != *user_selinux) {
argv[0] = "/usr/sbin/semanage";
argv[1] = "login";
argv[2] = "-m";
argv[3] = "-s";
argv[4] = user_selinux;
argv[5] = user_name;
argv[6] = NULL;
if (safe_system (argv[0], argv, NULL, true) != 0) {
argv[2] = "-a";
if (safe_system (argv[0], argv, NULL, false) != 0) {
fprintf (stderr,
_("%s: warning: the user name %s to %s SELinux user mapping failed.\n"),
Prog, user_name, user_selinux);
#ifdef WITH_AUDIT
audit_logger (AUDIT_USER_CHAUTHTOK, Prog,
"modifying User mapping ",
user_name, (unsigned int) user_id, 0);
#endif
}
}
}
}
#endif