>From 90bd88e09e185dbcdaec17b9a8a619a0fdc9589a Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sun, 5 Aug 2012 22:37:09 +0200 Subject: [PATCH 2/2] Only create the SELinux login file if there are mappings on the server https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches. --- src/db/sysdb_selinux.c | 7 +------ src/responder/pam/pamsrv_cmd.c | 46 ++++++++++++++++++++++++++++++++++-------- 2 files changed, 39 insertions(+), 14 deletions(-) diff --git a/src/db/sysdb_selinux.c b/src/db/sysdb_selinux.c index eaf07b50a4435b11f937473e37c708edc6e2e0eb..976489503e0995b7e025146c23a7f4e7874c1643 100644 --- a/src/db/sysdb_selinux.c +++ b/src/db/sysdb_selinux.c @@ -364,7 +364,7 @@ errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx, struct ldb_message **msgs = NULL; struct sysdb_attrs *user; struct sysdb_attrs *tmp_attrs; - struct ldb_message **usermaps; + struct ldb_message **usermaps = NULL; struct sss_domain_info *domain; struct ldb_dn *basedn; size_t msgs_count = 0; @@ -462,11 +462,6 @@ errno_t sysdb_search_selinux_usermap_by_username(TALLOC_CTX *mem_ctx, } } - if (usermaps[0] == NULL) { - ret = ENOENT; - goto done; - } - *_usermaps = talloc_steal(mem_ctx, usermaps); ret = EOK; diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c index 6b556a4d756ca04835dbbe7198b7324b5b8f4063..f12954d18d0622cf4a3f94cb96366ed7f978dc86 100644 --- a/src/responder/pam/pamsrv_cmd.c +++ b/src/responder/pam/pamsrv_cmd.c @@ -356,7 +356,13 @@ fail: #define ALL_SERVICES "*" -static errno_t write_selinux_string(const char *username, char *string) +static char *selogin_path(TALLOC_CTX *mem_ctx, const char *username) +{ + return talloc_asprintf(mem_ctx, "%s/logins/%s", selinux_policy_root(), + username); +} + +static errno_t write_selinux_login_file(const char *username, char *string) { char *path = NULL; char *tmp_path = NULL; @@ -379,8 +385,7 @@ static errno_t write_selinux_string(const char *username, char *string) return ENOMEM; } - path = talloc_asprintf(tmp_ctx, "%s/logins/%s", selinux_policy_root(), - username); + path = selogin_path(tmp_ctx, username); if (path == NULL) { ret = ENOMEM; goto done; @@ -448,7 +453,27 @@ done: return ret; } -static errno_t get_selinux_string(struct pam_auth_req *preq) +static errno_t remove_selinux_login_file(const char *username) +{ + char *path; + errno_t ret; + + path = selogin_path(NULL, username); + if (!path) return ENOMEM; + + errno = 0; + ret = unlink(path); + if (ret < 0) { + ret = errno; + DEBUG(SSSDBG_OP_FAILURE, ("Could not remove login file %s [%d]: %s\n", + path, ret, strerror(ret))); + } + + talloc_free(path); + return ret; +} + +static errno_t process_selinux_mappings(struct pam_auth_req *preq) { struct sysdb_ctx *sysdb; TALLOC_CTX *tmp_ctx; @@ -549,13 +574,16 @@ static errno_t get_selinux_string(struct pam_auth_req *preq) } if (ret == ENOENT) { - DEBUG(SSSDBG_TRACE_FUNC, ("No user maps found, using default!")); + DEBUG(SSSDBG_TRACE_FUNC, ("No maps defined on the server\n")); + } else { + /* If no maps match, we'll use the default SELinux user from the + config */ file_content = talloc_strdup(tmp_ctx, default_user); if (file_content == NULL) { ret = ENOMEM; goto done; } - } else { + /* Iterate through the order array and try to find SELinux users * in fetched maps. The order array contains all SELinux users * allowed in the domain in the same order they should appear @@ -589,7 +617,9 @@ static errno_t get_selinux_string(struct pam_auth_req *preq) } if (file_content) { - ret = write_selinux_string(pd->user, file_content); + ret = write_selinux_login_file(pd->user, file_content); + } else { + ret = remove_selinux_login_file(pd->user); } done: @@ -796,7 +826,7 @@ static void pam_reply(struct pam_auth_req *preq) pd->pam_status == PAM_SUCCESS) { /* Try to fetch data from sysdb * (auth already passed -> we should have them) */ - ret = get_selinux_string(preq); + ret = process_selinux_mappings(preq); if (ret != EOK) { pd->pam_status = PAM_SYSTEM_ERR; } -- 1.7.11.2