shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-02 10:51:20 +03:00
Code

core: make sure we have enough information when doing selinux decisions

Browse Source 
Let's ask for the security relevant bits in a race-free way, and augment
the rest from /proc.
This commit is contained in:
Lennart Poettering 2014-11-26 18:57:37 +01:00
parent 6dae84cbdd
commit 8fd0019380
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/dbus.c
View File

@ -776,6 +776,14 @@ static int bus_setup_api(Manager *m, sd_bus *bus) {
assert(m);
assert(bus);
/* Let's make sure we have enough credential bits so that we can make security and selinux decisions */
r = sd_bus_negotiate_creds(bus, 1,
SD_BUS_CREDS_PID|SD_BUS_CREDS_UID|
SD_BUS_CREDS_EUID|SD_BUS_CREDS_EFFECTIVE_CAPS|
SD_BUS_CREDS_SELINUX_CONTEXT);
if (r < 0)
log_warning("Failed to enable credential passing, ignoring: %s", strerror(-r));
r = bus_setup_api_vtables(m, bus);
if (r < 0)
return r;

3
src/core/selinux-access.c
View File

@ -207,7 +207,8 @@ int mac_selinux_generic_access_check(
message,
SD_BUS_CREDS_PID|SD_BUS_CREDS_UID|SD_BUS_CREDS_GID|
SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
SD_BUS_CREDS_SELINUX_CONTEXT,
SD_BUS_CREDS_SELINUX_CONTEXT|
SD_BUS_CREDS_AUGMENT /* get more bits from /proc */,
&creds);
if (r < 0)
goto finish;