svn commit: trunk/busybox: include libbb networking
vda at busybox.net
vda at busybox.net
Sat Oct 20 02:00:50 UTC 2007
Author: vda
Date: 2007-10-19 19:00:49 -0700 (Fri, 19 Oct 2007)
New Revision: 20303
Log:
ping: fix breakage from -I fix
passwd: SELinux support by KaiGai Kohei <kaigai at ak.jp.nec.com>
Modified:
trunk/busybox/include/libbb.h
trunk/busybox/libbb/selinux_common.c
trunk/busybox/libbb/update_passwd.c
trunk/busybox/networking/ping.c
Changeset:
Modified: trunk/busybox/include/libbb.h
===================================================================
--- trunk/busybox/include/libbb.h 2007-10-20 00:17:34 UTC (rev 20302)
+++ trunk/busybox/include/libbb.h 2007-10-20 02:00:49 UTC (rev 20303)
@@ -44,6 +44,8 @@
#if ENABLE_SELINUX
#include <selinux/selinux.h>
#include <selinux/context.h>
+#include <selinux/flask.h>
+#include <selinux/av_permissions.h>
#endif
#if ENABLE_LOCALE_SUPPORT
@@ -818,6 +820,9 @@
extern context_t set_security_context_component(security_context_t cur_context,
char *user, char *role, char *type, char *range);
extern void setfscreatecon_or_die(security_context_t scontext);
+extern void selinux_preserve_fcontext(int fdesc);
+#else
+#define selinux_preserve_fcontext(fdesc) ((void)0)
#endif
extern void selinux_or_die(void);
extern int restricted_shell(const char *shell);
Modified: trunk/busybox/libbb/selinux_common.c
===================================================================
--- trunk/busybox/libbb/selinux_common.c 2007-10-20 00:17:34 UTC (rev 20302)
+++ trunk/busybox/libbb/selinux_common.c 2007-10-20 02:00:49 UTC (rev 20303)
@@ -38,3 +38,17 @@
"file creation context to %s", scontext);
}
}
+
+void selinux_preserve_fcontext(int fdesc)
+{
+ security_context_t context;
+
+ if (fgetfilecon(fdesc, &context) < 0) {
+ if (errno == ENODATA || errno == ENOTSUP)
+ return;
+ bb_perror_msg_and_die("fgetfilecon failed");
+ }
+ setfscreatecon_or_die(context);
+ freecon(context);
+}
+
Modified: trunk/busybox/libbb/update_passwd.c
===================================================================
--- trunk/busybox/libbb/update_passwd.c 2007-10-20 00:17:34 UTC (rev 20302)
+++ trunk/busybox/libbb/update_passwd.c 2007-10-20 02:00:49 UTC (rev 20303)
@@ -11,6 +11,31 @@
#include "libbb.h"
+#if ENABLE_SELINUX
+static void check_selinux_update_passwd(const char *username)
+{
+ security_context_t context;
+ char *seuser;
+
+ if (getuid() != (uid_t)0 || is_selinux_enabled() == 0)
+ return; /* No need to check */
+
+ if (getprevcon_raw(&context) < 0)
+ bb_perror_msg_and_die("getprevcon failed");
+ seuser = strtok(context, ":");
+ if (!seuser)
+ bb_error_msg_and_die("invalid context '%s'", context);
+ if (strcmp(seuser, username) != 0) {
+ if (checkPasswdAccess(PASSWD__PASSWD) != 0)
+ bb_error_msg_and_die("SELinux: access denied");
+ }
+ if (ENABLE_FEATURE_CLEAN_UP)
+ freecon(context);
+}
+#else
+#define check_selinux_update_passwd(username) ((void)0)
+#endif
+
int update_passwd(const char *filename, const char *username,
const char *new_pw)
{
@@ -27,6 +52,8 @@
int cnt = 0;
int ret = -1; /* failure */
+ check_selinux_update_passwd(username);
+
/* New passwd file, "/etc/passwd+" for now */
fnamesfx = xasprintf("%s+", filename);
sfx_char = &fnamesfx[strlen(fnamesfx)-1];
@@ -38,6 +65,8 @@
goto free_mem;
old_fd = fileno(old_fp);
+ selinux_preserve_fcontext(old_fd);
+
/* Try to create "/etc/passwd+". Wait if it exists. */
i = 30;
do {
Modified: trunk/busybox/networking/ping.c
===================================================================
--- trunk/busybox/networking/ping.c 2007-10-20 00:17:34 UTC (rev 20302)
+++ trunk/busybox/networking/ping.c 2007-10-20 02:00:49 UTC (rev 20303)
@@ -540,7 +540,7 @@
xbind(pingsock, &source_lsa->sa, source_lsa->len);
}
if (opt_I)
- setsockopt(pingsock, SOL_SOCKET, SO_BINDTODEVICE, device, strlen(opt_I) + 1);
+ setsockopt(pingsock, SOL_SOCKET, SO_BINDTODEVICE, opt_I, strlen(opt_I) + 1);
/* enable broadcast pings */
setsockopt_broadcast(pingsock);
@@ -589,7 +589,7 @@
if (source_lsa)
xbind(pingsock, &source_lsa->sa, source_lsa->len);
if (opt_I)
- setsockopt(pingsock, SOL_SOCKET, SO_BINDTODEVICE, device, strlen(opt_I) + 1);
+ setsockopt(pingsock, SOL_SOCKET, SO_BINDTODEVICE, opt_I, strlen(opt_I) + 1);
#ifdef ICMP6_FILTER
{
More information about the busybox-cvs
mailing list