|
 |
91f5f14 |
diff --git a/nscd/selinux.c b/nscd/selinux.c
|
|
|
91f5f14 |
index 0866c44..ba55b04 100644
|
|
|
91f5f14 |
--- a/nscd/selinux.c
|
|
|
91f5f14 |
+++ b/nscd/selinux.c
|
|
|
91f5f14 |
@@ -44,35 +44,31 @@
|
|
|
91f5f14 |
/* Global variable to tell if the kernel has SELinux support. */
|
|
|
91f5f14 |
int selinux_enabled;
|
|
|
91f5f14 |
|
|
|
91f5f14 |
-/* Define mappings of access vector permissions to request types. */
|
|
|
91f5f14 |
-static const access_vector_t perms[LASTREQ] =
|
|
|
91f5f14 |
+/* Define mappings of request type to AVC permission name. */
|
|
|
91f5f14 |
+static const char *perms[LASTREQ] =
|
|
|
91f5f14 |
{
|
|
|
91f5f14 |
- [GETPWBYNAME] = NSCD__GETPWD,
|
|
|
91f5f14 |
- [GETPWBYUID] = NSCD__GETPWD,
|
|
|
91f5f14 |
- [GETGRBYNAME] = NSCD__GETGRP,
|
|
|
91f5f14 |
- [GETGRBYGID] = NSCD__GETGRP,
|
|
|
91f5f14 |
- [GETHOSTBYNAME] = NSCD__GETHOST,
|
|
|
91f5f14 |
- [GETHOSTBYNAMEv6] = NSCD__GETHOST,
|
|
|
91f5f14 |
- [GETHOSTBYADDR] = NSCD__GETHOST,
|
|
|
91f5f14 |
- [GETHOSTBYADDRv6] = NSCD__GETHOST,
|
|
|
91f5f14 |
- [GETSTAT] = NSCD__GETSTAT,
|
|
|
91f5f14 |
- [SHUTDOWN] = NSCD__ADMIN,
|
|
|
91f5f14 |
- [INVALIDATE] = NSCD__ADMIN,
|
|
|
91f5f14 |
- [GETFDPW] = NSCD__SHMEMPWD,
|
|
|
91f5f14 |
- [GETFDGR] = NSCD__SHMEMGRP,
|
|
|
91f5f14 |
- [GETFDHST] = NSCD__SHMEMHOST,
|
|
|
91f5f14 |
- [GETAI] = NSCD__GETHOST,
|
|
|
91f5f14 |
- [INITGROUPS] = NSCD__GETGRP,
|
|
|
91f5f14 |
-#ifdef NSCD__GETSERV
|
|
|
91f5f14 |
- [GETSERVBYNAME] = NSCD__GETSERV,
|
|
|
91f5f14 |
- [GETSERVBYPORT] = NSCD__GETSERV,
|
|
|
91f5f14 |
- [GETFDSERV] = NSCD__SHMEMSERV,
|
|
|
91f5f14 |
-#endif
|
|
|
91f5f14 |
-#ifdef NSCD__GETNETGRP
|
|
|
91f5f14 |
- [GETNETGRENT] = NSCD__GETNETGRP,
|
|
|
91f5f14 |
- [INNETGR] = NSCD__GETNETGRP,
|
|
|
91f5f14 |
- [GETFDNETGR] = NSCD__SHMEMNETGRP,
|
|
|
91f5f14 |
-#endif
|
|
|
91f5f14 |
+ [GETPWBYNAME] = "getpwd",
|
|
|
91f5f14 |
+ [GETPWBYUID] = "getpwd",
|
|
|
91f5f14 |
+ [GETGRBYNAME] = "getgrp",
|
|
|
91f5f14 |
+ [GETGRBYGID] = "getgrp",
|
|
|
91f5f14 |
+ [GETHOSTBYNAME] = "gethost",
|
|
|
91f5f14 |
+ [GETHOSTBYNAMEv6] = "gethost",
|
|
|
91f5f14 |
+ [GETHOSTBYADDR] = "gethost",
|
|
|
91f5f14 |
+ [GETHOSTBYADDRv6] = "gethost",
|
|
|
91f5f14 |
+ [SHUTDOWN] = "admin",
|
|
|
91f5f14 |
+ [GETSTAT] = "getstat",
|
|
|
91f5f14 |
+ [INVALIDATE] = "admin",
|
|
|
91f5f14 |
+ [GETFDPW] = "shmempwd",
|
|
|
91f5f14 |
+ [GETFDGR] = "shmemgrp",
|
|
|
91f5f14 |
+ [GETFDHST] = "shmemhost",
|
|
|
91f5f14 |
+ [GETAI] = "gethost",
|
|
|
91f5f14 |
+ [INITGROUPS] = "getgrp",
|
|
|
91f5f14 |
+ [GETSERVBYNAME] = "getserv",
|
|
|
91f5f14 |
+ [GETSERVBYPORT] = "getserv",
|
|
|
91f5f14 |
+ [GETFDSERV] = "shmemserv",
|
|
|
91f5f14 |
+ [GETNETGRENT] = "getnetgrp",
|
|
|
91f5f14 |
+ [INNETGR] = "getnetgrp",
|
|
|
91f5f14 |
+ [GETFDNETGR] = "shmemnetgrp",
|
|
|
91f5f14 |
};
|
|
|
91f5f14 |
|
|
|
91f5f14 |
/* Store an entry ref to speed AVC decisions. */
|
|
|
91f5f14 |
@@ -344,7 +340,18 @@ nscd_avc_init (void)
|
|
|
91f5f14 |
|
|
|
91f5f14 |
|
|
|
91f5f14 |
/* Check the permission from the caller (via getpeercon) to nscd.
|
|
|
91f5f14 |
- Returns 0 if access is allowed, 1 if denied, and -1 on error. */
|
|
|
91f5f14 |
+ Returns 0 if access is allowed, 1 if denied, and -1 on error.
|
|
|
91f5f14 |
+
|
|
|
91f5f14 |
+ Implementation note:
|
|
|
91f5f14 |
+ The SELinux policy, enablement, and permission bits are all dynamic
|
|
|
91f5f14 |
+ and the caching done by glibc is not entirely correct. This nscd
|
|
|
91f5f14 |
+ support should be rewritten to use selinux_check_permission.
|
|
|
91f5f14 |
+ A rewrite is risky though and requires some refactoring fist.
|
|
|
91f5f14 |
+ Instead we use symbolic mappings instead of compile time
|
|
|
91f5f14 |
+ constants (which selinux upstream says are going away), and use
|
|
|
91f5f14 |
+ security_deny_unknown to determine what to do if selinux-policy
|
|
|
91f5f14 |
+ doesn't have a definition for the the permission or object class
|
|
|
91f5f14 |
+ we are looking up. */
|
|
|
91f5f14 |
int
|
|
|
91f5f14 |
nscd_request_avc_has_perm (int fd, request_type req)
|
|
|
91f5f14 |
{
|
|
|
91f5f14 |
@@ -354,6 +361,33 @@ nscd_request_avc_has_perm (int fd, request_type req)
|
|
|
91f5f14 |
security_id_t ssid = NULL;
|
|
|
91f5f14 |
security_id_t tsid = NULL;
|
|
|
91f5f14 |
int rc = -1;
|
|
|
91f5f14 |
+ security_class_t sc_nscd = 0;
|
|
|
91f5f14 |
+ access_vector_t perm = 0;
|
|
|
91f5f14 |
+ int avc_deny_unknown = 0;
|
|
|
91f5f14 |
+
|
|
|
91f5f14 |
+ /* Check if SELinux denys or allows unknown object classes
|
|
|
91f5f14 |
+ and permissions. It is 0 if they are allowed, 1 if they
|
|
|
91f5f14 |
+ are not allowed and -1 on error. */
|
|
|
91f5f14 |
+ if ((avc_deny_unknown = security_deny_unknown ()) == -1)
|
|
|
91f5f14 |
+ dbg_log (_("Error querying policy for undefined object classes "
|
|
|
91f5f14 |
+ "or permissions."));
|
|
|
91f5f14 |
+
|
|
|
91f5f14 |
+ /* Get the security class for nscd. If this fails we will likely be
|
|
|
91f5f14 |
+ unable to do anything unless avc_deny_unknown is 0. */
|
|
|
91f5f14 |
+ if ((sc_nscd = string_to_security_class ("nscd")) == 0
|
|
|
91f5f14 |
+ && avc_deny_unknown == 1)
|
|
|
91f5f14 |
+ dbg_log (_("Error getting security class for nscd."));
|
|
|
91f5f14 |
+
|
|
|
91f5f14 |
+ /* Convert permission to AVC bits. */
|
|
|
91f5f14 |
+ perm = string_to_av_perm (sc_nscd, perms[req]);
|
|
|
91f5f14 |
+ if (perm == 0 && avc_deny_unknown == 1)
|
|
|
91f5f14 |
+ dbg_log (_("Error translating permission name "
|
|
|
91f5f14 |
+ "\"%s\" to access vector bit."), perms[req]);
|
|
|
91f5f14 |
+
|
|
|
91f5f14 |
+ /* If the nscd security class was not found or perms were not
|
|
|
91f5f14 |
+ found and AVC does not deny unknown values then allow it. */
|
|
|
91f5f14 |
+ if ((sc_nscd == 0 || perm == 0) && avc_deny_unknown == 0)
|
|
|
91f5f14 |
+ return 0;
|
|
|
91f5f14 |
|
|
|
91f5f14 |
if (getpeercon (fd, &scon) < 0)
|
|
|
91f5f14 |
{
|
|
|
91f5f14 |
@@ -372,15 +406,7 @@ nscd_request_avc_has_perm (int fd, request_type req)
|
|
|
91f5f14 |
goto out;
|
|
|
91f5f14 |
}
|
|
|
91f5f14 |
|
|
|
91f5f14 |
-#ifndef NSCD__GETSERV
|
|
|
91f5f14 |
- if (perms[req] == 0)
|
|
|
91f5f14 |
- {
|
|
|
91f5f14 |
- dbg_log (_("compile-time support for database policy missing"));
|
|
|
91f5f14 |
- goto out;
|
|
|
91f5f14 |
- }
|
|
|
91f5f14 |
-#endif
|
|
|
91f5f14 |
-
|
|
|
91f5f14 |
- rc = avc_has_perm (ssid, tsid, SECCLASS_NSCD, perms[req], &aeref, NULL) < 0;
|
|
|
91f5f14 |
+ rc = avc_has_perm (ssid, tsid, sc_nscd, perm, &aeref, NULL) < 0;
|
|
|
91f5f14 |
|
|
|
91f5f14 |
out:
|
|
|
91f5f14 |
if (scon)
|