[SSSD] [PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to root

Jakub Hrozek jhrozek at redhat.com
Mon Jan 26 17:22:23 UTC 2015


Hi,

Please see the commit message and the ticket description. Also please
note that if you're testing with a non-privileged user, you also need to
set:

allow sssd_selinux_manager_t self:capability setgid;
allow sssd_selinux_manager_t self:capability setuid;

Otherwise there will be AVC denials.
-------------- next part --------------
>From cc6045f0ef3a40de7a971ab95bac19bc1cecc046 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 26 Jan 2015 15:15:29 +0100
Subject: [PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to
 root

https://fedorahosted.org/sssd/ticket/2564

libselinux uses many access(2) calls and access() uses the real UID,
not the effective UID for the check. Therefore, the setuid selinux_child,
which only has effective UID of root would fail the check.
---
 src/providers/ipa/selinux_child.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index cb6f96415690c3931be52167b6ccb7f081a52a6f..6390d43cbe4f3d352702493c156f93ca20b07a2f 100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -197,7 +197,23 @@ int main(int argc, const char *argv[])
 
     DEBUG(SSSDBG_TRACE_FUNC, "selinux_child started.\n");
     DEBUG(SSSDBG_TRACE_INTERNAL,
-          "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
+          "Running with effective IDs: [%"SPRIuid"][%"SPRIgid"].\n",
+          geteuid(), getegid());
+
+    /* libsemanage calls access(2) which works with real IDs, not effective.
+     * We need to switch also the real ID to 0.
+     */
+    if (getuid() != 0) {
+        setuid(0);
+    }
+
+    if (getgid() != 0) {
+        setgid(0);
+    }
+
+    DEBUG(SSSDBG_TRACE_INTERNAL,
+          "Running with real IDs [%"SPRIuid"][%"SPRIgid"].\n",
+          getuid(), getgid());
 
     main_ctx = talloc_new(NULL);
     if (main_ctx == NULL) {
-- 
2.1.0



More information about the sssd-devel mailing list