>From 0d40464b1e9a555700349105c5e87b055e0286d6 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 27 Jan 2015 11:12:18 +0100 Subject: [PATCH] SELINUX: Set and reset umask when caling set_seuser from deamon code --- src/providers/ipa/selinux_child.c | 14 +++++++++++++- src/util/util.h | 4 ++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c index 6390d43cbe4f3d352702493c156f93ca20b07a2f..ec47ed818efb3ebc93c780a2b0fe6d900e463f2c 100644 --- a/src/providers/ipa/selinux_child.c +++ b/src/providers/ipa/selinux_child.c @@ -135,6 +135,18 @@ static errno_t prepare_response(TALLOC_CTX *mem_ctx, return EOK; } +static int sc_set_seuser(const char *login_name, const char *seuser_name, + const char *mls) +{ + int ret; + mode_t old_mask; + + old_mask = umask(0); + ret = set_seuser(login_name, seuser_name, mls); + umask(old_mask); + return ret; +} + int main(int argc, const char *argv[]) { int opt; @@ -256,7 +268,7 @@ int main(int argc, const char *argv[]) DEBUG(SSSDBG_TRACE_FUNC, "performing selinux operations\n"); - ret = set_seuser(ibuf->username, ibuf->seuser, ibuf->mls_range); + ret = sc_set_seuser(ibuf->username, ibuf->seuser, ibuf->mls_range); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot set SELinux login context.\n"); goto fail; diff --git a/src/util/util.h b/src/util/util.h index 4ee9bad113299d8fb3eabebec508c2ab4c80d4e9..22d6ef0a4e1340346d3d2997313aab50410f9dc0 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -640,6 +640,10 @@ errno_t switch_creds(TALLOC_CTX *mem_ctx, errno_t restore_creds(struct sss_creds *saved_creds); /* from sss_semanage.c */ +/* Please note that libsemange relies on files and directories created with + * certain permissions. Therefore the caller should make sure the umask is + * not too restricted (especially when called from the daemon code). + */ int set_seuser(const char *login_name, const char *seuser_name, const char *mlsrange); int del_seuser(const char *login_name); -- 2.1.0