[SSSD] [PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to root
Jakub Hrozek
jhrozek at redhat.com
Mon Jan 26 17:22:23 UTC 2015
Hi,
Please see the commit message and the ticket description. Also please
note that if you're testing with a non-privileged user, you also need to
set:
allow sssd_selinux_manager_t self:capability setgid;
allow sssd_selinux_manager_t self:capability setuid;
Otherwise there will be AVC denials.
-------------- next part --------------
>From cc6045f0ef3a40de7a971ab95bac19bc1cecc046 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 26 Jan 2015 15:15:29 +0100
Subject: [PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to
root
https://fedorahosted.org/sssd/ticket/2564
libselinux uses many access(2) calls and access() uses the real UID,
not the effective UID for the check. Therefore, the setuid selinux_child,
which only has effective UID of root would fail the check.
---
src/providers/ipa/selinux_child.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index cb6f96415690c3931be52167b6ccb7f081a52a6f..6390d43cbe4f3d352702493c156f93ca20b07a2f 100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -197,7 +197,23 @@ int main(int argc, const char *argv[])
DEBUG(SSSDBG_TRACE_FUNC, "selinux_child started.\n");
DEBUG(SSSDBG_TRACE_INTERNAL,
- "Running as [%"SPRIuid"][%"SPRIgid"].\n", geteuid(), getegid());
+ "Running with effective IDs: [%"SPRIuid"][%"SPRIgid"].\n",
+ geteuid(), getegid());
+
+ /* libsemanage calls access(2) which works with real IDs, not effective.
+ * We need to switch also the real ID to 0.
+ */
+ if (getuid() != 0) {
+ setuid(0);
+ }
+
+ if (getgid() != 0) {
+ setgid(0);
+ }
+
+ DEBUG(SSSDBG_TRACE_INTERNAL,
+ "Running with real IDs [%"SPRIuid"][%"SPRIgid"].\n",
+ getuid(), getgid());
main_ctx = talloc_new(NULL);
if (main_ctx == NULL) {
--
2.1.0
More information about the sssd-devel
mailing list