[SSSD] [PATCH] Move settig the SELinux context into a privileged child process

Jakub Hrozek jhrozek at redhat.com
Thu Nov 6 18:21:54 UTC 2014


On Thu, Nov 06, 2014 at 05:27:30PM +0100, Lukas Slebodnik wrote:
> On (06/11/14 16:40), Michal Židek wrote:
> >On 11/06/2014 12:09 PM, Lukas Slebodnik wrote:
> >>>+    DEBUG(SSSDBG_TRACE_FUNC, "performing selinux operations\n");
> >>>+
> >>>+    ret = set_seuser(ibuf->username, ibuf->seuser, ibuf->mls_range);
> >>>+
> >>>+    ret = prepare_response(main_ctx, ret, &resp);
> >>       ^^^
> >>return value is not tested. It might happen that resp will not be used
> >>initialized in sss_atomic_write_s.
> >>>+
> >>>+    errno = 0;
> >>>+
> >>>+    written = sss_atomic_write_s(STDOUT_FILENO, resp->buf, resp->size);
> >>>+    if (written == -1) {
> >>>+        ret = errno;
> >>>+        DEBUG(SSSDBG_CRIT_FAILURE, "write failed [%d][%s].\n", ret,
> >>>+                    strerror(ret));
> >>>+        goto fail;
> >>>+    }
> >>
> >>html report from clang is attached.
> >>
> >>LS
> >>
> >
> >Thanks, please see the attached simple patch.
> >
> >Michal
> 
> >From 3942a3acfa1a46b68163ecbc2566b8c2599f3c61 Mon Sep 17 00:00:00 2001
> >From: Michal Zidek <mzidek at redhat.com>
> >Date: Thu, 6 Nov 2014 16:35:11 +0100
> >Subject: [PATCH] selinux_child: Do not ignore return values.
> >
> >---
> > src/providers/ipa/selinux_child.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> >diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
> >index a624cfd..a38ffcb 100644
> ACK
> 
> LS

* master: 013c01bd491b535e1705dbb3dbd8424cffc66b7a



More information about the sssd-devel mailing list