diff options
author | Darren Tucker <dtucker@zip.com.au> | 2009-10-24 15:04:12 +1100 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2009-10-24 15:04:12 +1100 |
commit | 4d6656b1030c2090f8769ce9cce0a9e5dd135945 (patch) | |
tree | 6cd9e06190cfbe4be752b82de995cb09d9303e9b /openbsd-compat/port-linux.c | |
parent | 6ac91a7c83a7343e9fdf24c2857b301b50e21a9c (diff) |
- (dtucker) [session.c openbsd-compat/port-linux.{c,h}] Bug #1637: if selinux
is enabled set the security context to "sftpd_t" before running the
internal sftp server Based on a patch from jchadima at redhat.
Diffstat (limited to 'openbsd-compat/port-linux.c')
-rw-r--r-- | openbsd-compat/port-linux.c | 37 |
1 files changed, 36 insertions, 1 deletions
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index ad262758e..88c601e20 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $Id: port-linux.c,v 1.5 2008/03/26 20:27:21 dtucker Exp $ */ | 1 | /* $Id: port-linux.c,v 1.6 2009/10/24 04:04:13 dtucker Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> | 4 | * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> |
@@ -29,6 +29,7 @@ | |||
29 | 29 | ||
30 | #ifdef WITH_SELINUX | 30 | #ifdef WITH_SELINUX |
31 | #include "log.h" | 31 | #include "log.h" |
32 | #include "xmalloc.h" | ||
32 | #include "port-linux.h" | 33 | #include "port-linux.h" |
33 | 34 | ||
34 | #include <selinux/selinux.h> | 35 | #include <selinux/selinux.h> |
@@ -168,4 +169,38 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) | |||
168 | freecon(user_ctx); | 169 | freecon(user_ctx); |
169 | debug3("%s: done", __func__); | 170 | debug3("%s: done", __func__); |
170 | } | 171 | } |
172 | |||
173 | void | ||
174 | ssh_selinux_change_context(const char *newname) | ||
175 | { | ||
176 | int len, newlen; | ||
177 | char *oldctx, *newctx, *cx; | ||
178 | |||
179 | if (!ssh_selinux_enabled()) | ||
180 | return; | ||
181 | |||
182 | if (getcon((security_context_t *)&oldctx) < 0) { | ||
183 | logit("%s: getcon failed with %s", __func__, strerror (errno)); | ||
184 | return; | ||
185 | } | ||
186 | if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) == | ||
187 | NULL) { | ||
188 | logit ("%s: unparseable context %s", __func__, oldctx); | ||
189 | return; | ||
190 | } | ||
191 | |||
192 | newlen = strlen(oldctx) + strlen(newname) + 1; | ||
193 | newctx = xmalloc(newlen); | ||
194 | len = cx - oldctx + 1; | ||
195 | memcpy(newctx, oldctx, len); | ||
196 | strlcpy(newctx + len, newname, newlen - len); | ||
197 | if ((cx = index(cx + 1, ':'))) | ||
198 | strlcat(newctx, cx, newlen); | ||
199 | debug3("%s: setting context from '%s' to '%s'", __func__, oldctx, | ||
200 | newctx); | ||
201 | if (setcon(newctx) < 0) | ||
202 | logit("%s: setcon failed with %s", __func__, strerror (errno)); | ||
203 | xfree(oldctx); | ||
204 | xfree(newctx); | ||
205 | } | ||
171 | #endif /* WITH_SELINUX */ | 206 | #endif /* WITH_SELINUX */ |