emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

migrate to new SELinux api

Browse Source 
Using hard-coded access vector ids is deprecated and can lead to issues with custom SELinux policies.
Switch to `selinux_check_access()`.

Also use the libselinux log callback and log if available to audit.
This makes it easier for users to catch SELinux denials.

Drop legacy shortcut logic for passwd, which avoided a SELinux check if uid 0 changes a password of a user which username equals the current SELinux user identifier.
Nowadays usernames rarely match SELinux user identifiers and the benefit of skipping a SELinux check is negligible.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche
2019-10-15 23:33:54 +02:00
parent a0efca4581
commit cbd2472b7c
7 changed files with 125 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/chfn.c
View File

@ -40,10 +40,6 @@
#include <stdio.h>
#include <sys/types.h>
#include <getopt.h>
#ifdef WITH_SELINUX
#include <selinux/selinux.h>
#include <selinux/av_permissions.h>
#endif
#include "defines.h"
#include "getdef.h"
#include "nscd.h"
@ -379,8 +375,7 @@ static void check_perms (const struct passwd *pw)
* check if the change is allowed by SELinux policy.
*/
if ((pw->pw_uid != getuid ())
&& (is_selinux_enabled () > 0)
&& (selinux_check_passwd_access (PASSWD__CHFN) != 0)) {
&& (check_selinux_permit ("chfn") != 0)) {
fprintf (stderr, _("%s: Permission denied.\n"), Prog);
closelog ();
exit (E_NOPERM);