|
 |
1504793 |
From fd4291d5e4e811a0e484a06d88509f4adfed6a90 Mon Sep 17 00:00:00 2001
|
|
|
1504793 |
From: Ray Strode <rstrode@redhat.com>
|
|
|
1504793 |
Date: Thu, 6 Sep 2012 17:01:03 -0400
|
|
|
1504793 |
Subject: [PATCH 1/2] configure: check for selinux again
|
|
|
1504793 |
|
|
|
1504793 |
This sort of reverts commit 378390b9b5639bbe37cf4ba06e2e4acf1587e1d8.
|
|
|
1504793 |
---
|
|
|
1504793 |
configure.ac | 9 +++++++++
|
|
|
1504793 |
1 file changed, 9 insertions(+)
|
|
|
1504793 |
|
|
|
1504793 |
diff --git a/configure.ac b/configure.ac
|
|
|
1504793 |
index 5283845..af31719 100644
|
|
|
1504793 |
--- a/configure.ac
|
|
|
1504793 |
+++ b/configure.ac
|
|
|
1504793 |
@@ -142,6 +142,14 @@ AC_SUBST(UPOWER)
|
|
|
1504793 |
AC_SUBST(UPOWER_CFLAGS)
|
|
|
1504793 |
AC_SUBST(UPOWER_LIBS)
|
|
|
1504793 |
|
|
|
1504793 |
+PKG_CHECK_MODULES(LIBSELINUX, libselinux, have_selinux=yes, have_selinux=no)
|
|
|
1504793 |
+
|
|
|
1504793 |
+if test "x$have_selinux" = "xyes" ; then
|
|
|
1504793 |
+ AC_DEFINE(HAVE_SELINUX, 1, [Define if have selinux])
|
|
|
1504793 |
+fi
|
|
|
1504793 |
+AC_SUBST(LIBSELINUX_CFLAGS)
|
|
|
1504793 |
+AC_SUBST(LIBSELINUX_LIBS)
|
|
|
1504793 |
+
|
|
|
1504793 |
PKG_CHECK_MODULES(SIMPLE_GREETER,
|
|
|
1504793 |
gtk+-3.0 >= $GTK_REQUIRED_VERSION
|
|
|
1504793 |
fontconfig >= $FONTCONFIG_REQUIRED_VERSION
|
|
|
1504793 |
@@ -1595,6 +1603,7 @@ fi
|
|
|
1504793 |
echo \
|
|
|
1504793 |
" Xinerama support: ${XINERAMA_SUPPORT}
|
|
|
1504793 |
XDMCP support: ${XDMCP_SUPPORT}
|
|
|
1504793 |
+ SELinux support: ${have_selinux}
|
|
|
1504793 |
ConsoleKit support: ${use_console_kit}
|
|
|
1504793 |
systemd support: ${use_systemd}
|
|
|
1504793 |
systemd unit dir: ${with_systemdsystemunitdir}
|
|
|
1504793 |
--
|
|
|
1504793 |
1.7.12
|
|
|
1504793 |
|
|
|
1504793 |
|
|
|
1504793 |
From d4dbdc8c5a5703f205540d0c39459e1a06faf458 Mon Sep 17 00:00:00 2001
|
|
|
1504793 |
From: Ray Strode <rstrode@redhat.com>
|
|
|
1504793 |
Date: Thu, 6 Sep 2012 17:14:06 -0400
|
|
|
1504793 |
Subject: [PATCH 2/2] daemon: reset exec context after fork()
|
|
|
1504793 |
|
|
|
1504793 |
When pam_open_session finishes, the session worker
|
|
|
1504793 |
is set up such that the next fork()/exec() may transition the
|
|
|
1504793 |
user to a user specific context (such as staff_t).
|
|
|
1504793 |
|
|
|
1504793 |
This makes sense for the first fork()/exec() (which is the user
|
|
|
1504793 |
login), but the worker may fork()/exec() other workers after login
|
|
|
1504793 |
for unlock operations. These workers need to run in a gdm context
|
|
|
1504793 |
not a user context.
|
|
|
1504793 |
|
|
|
1504793 |
This commit changes gdm-session-worker to manually reset the exec()
|
|
|
1504793 |
context after the first fork().
|
|
|
1504793 |
|
|
|
1504793 |
https://bugzilla.gnome.org/show_bug.cgi?id=683426
|
|
|
1504793 |
---
|
|
|
1504793 |
daemon/Makefile.am | 2 ++
|
|
|
1504793 |
daemon/gdm-session-worker.c | 11 +++++++++++
|
|
|
1504793 |
2 files changed, 13 insertions(+)
|
|
|
1504793 |
|
|
|
1504793 |
diff --git a/daemon/Makefile.am b/daemon/Makefile.am
|
|
|
1504793 |
index 8d0cf5e..bb84765 100644
|
|
|
1504793 |
--- a/daemon/Makefile.am
|
|
|
1504793 |
+++ b/daemon/Makefile.am
|
|
|
1504793 |
@@ -27,6 +27,7 @@ AM_CPPFLAGS = \
|
|
|
1504793 |
$(WARN_CFLAGS) \
|
|
|
1504793 |
$(DEBUG_CFLAGS) \
|
|
|
1504793 |
$(SYSTEMD_CFLAGS) \
|
|
|
1504793 |
+ $(LIBSELINUX_CFLAGS) \
|
|
|
1504793 |
-DLANG_CONFIG_FILE=\"$(LANG_CONFIG_FILE)\" \
|
|
|
1504793 |
$(NULL)
|
|
|
1504793 |
|
|
|
1504793 |
@@ -291,6 +292,7 @@ gdm_session_worker_LDADD = \
|
|
|
1504793 |
$(top_builddir)/common/libgdmcommon.la \
|
|
|
1504793 |
$(DAEMON_LIBS) \
|
|
|
1504793 |
$(SYSTEMD_LIBS) \
|
|
|
1504793 |
+ $(LIBSELINUX_LIBS) \
|
|
|
1504793 |
$(NULL)
|
|
|
1504793 |
|
|
|
1504793 |
sbin_PROGRAMS = \
|
|
|
1504793 |
diff --git a/daemon/gdm-session-worker.c b/daemon/gdm-session-worker.c
|
|
|
1504793 |
index 190123d..1ccc0b7 100644
|
|
|
1504793 |
--- a/daemon/gdm-session-worker.c
|
|
|
1504793 |
+++ b/daemon/gdm-session-worker.c
|
|
|
1504793 |
@@ -46,6 +46,10 @@
|
|
|
1504793 |
#include <systemd/sd-daemon.h>
|
|
|
1504793 |
#endif
|
|
|
1504793 |
|
|
|
1504793 |
+#ifdef HAVE_SELINUX
|
|
|
1504793 |
+#include <selinux/selinux.h>
|
|
|
1504793 |
+#endif /* HAVE_SELINUX */
|
|
|
1504793 |
+
|
|
|
1504793 |
#include "gdm-common.h"
|
|
|
1504793 |
#include "gdm-log.h"
|
|
|
1504793 |
#include "gdm-session-worker.h"
|
|
|
1504793 |
@@ -1876,6 +1880,13 @@ gdm_session_worker_start_session (GdmSessionWorker *worker,
|
|
|
1504793 |
_exit (127);
|
|
|
1504793 |
}
|
|
|
1504793 |
|
|
|
1504793 |
+ /* If we end up execing again, make sure we don't use the executable context set up
|
|
|
1504793 |
+ * by pam_selinux durin pam_open_session
|
|
|
1504793 |
+ */
|
|
|
1504793 |
+#ifdef HAVE_SELINUX
|
|
|
1504793 |
+ setexeccon (NULL);
|
|
|
1504793 |
+#endif
|
|
|
1504793 |
+
|
|
|
1504793 |
worker->priv->child_pid = session_pid;
|
|
|
1504793 |
|
|
|
1504793 |
g_debug ("GdmSessionWorker: session opened creating reply...");
|
|
|
1504793 |
--
|
|
|
1504793 |
1.7.12
|
|
|
1504793 |
|