[SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations

Jakub Hrozek jhrozek at redhat.com
Mon Jan 26 17:18:26 UTC 2015


Hi,

to reproduce, set a SELinux label for a user. Log in as the user and
observer the permissions of /etc/selinux/targeted/modules/active
changing to 0600. As a result, even local semanage tools didn't work..
-------------- next part --------------
>From dbe42c9ca20df500d09949512b86c86f7b4ce7ce Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 26 Jan 2015 16:55:42 +0100
Subject: [PATCH] SELINUX: Set permissive umask for selinux operations

https://fedorahosted.org/sssd/ticket/2563

libsemanage calls mkdir() and then requires that the directory is created
with permissions 0700. That doesn't work well for programs like sssd that
set umask to a very restrictive value (like 177).
---
 src/util/sss_semanage.c | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c
index 3c566553f2085a696f79c5ee35ec6015824d56a6..4de0ce2bb4d52852cc7fa4df8a3e92b667c27c81 100644
--- a/src/util/sss_semanage.c
+++ b/src/util/sss_semanage.c
@@ -216,8 +216,8 @@ done:
     return ret;
 }
 
-int set_seuser(const char *login_name, const char *seuser_name,
-               const char *mls)
+int _set_seuser(const char *login_name, const char *seuser_name,
+                const char *mls)
 {
     semanage_handle_t *handle = NULL;
     semanage_seuser_key_t *key = NULL;
@@ -282,7 +282,19 @@ done:
     return ret;
 }
 
-int del_seuser(const char *login_name)
+int set_seuser(const char *login_name, const char *seuser_name,
+               const char *mls)
+{
+    mode_t old_mask;
+    int ret;
+
+    old_mask = umask(0);
+    ret = _set_seuser(login_name, seuser_name, mls);
+    umask(old_mask);
+    return ret;
+}
+
+static int _del_seuser(const char *login_name)
 {
     semanage_handle_t *handle = NULL;
     semanage_seuser_key_t *key = NULL;
@@ -353,6 +365,17 @@ done:
     return ret;
 }
 
+int del_seuser(const char *login_name)
+{
+    mode_t old_mask;
+    int ret;
+
+    old_mask = umask(0);
+    ret = _del_seuser(login_name);
+    umask(old_mask);
+    return ret;
+}
+
 #else /* HAVE_SEMANAGE */
 int set_seuser(const char *login_name, const char *seuser_name,
                const char *mls)
-- 
2.1.0



More information about the sssd-devel mailing list