selinux_utils.c - master - githubmirror/passwd

selinux_utils.c
99 строк3 KB
Miloslav Trmač
Fix missing va_end() call
30 ноя 2012, 00:42
30 ноя 2012, 00:42e06787e
/*
 * Copyright Red Hat, Inc., 2003,2004.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, and the entire permission notice in its entirety,
 *    including the disclaimer of warranties.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote
 *    products derived from this software without specific prior
 *    written permission.
 *
 * ALTERNATIVELY, this product may be distributed under the terms of
 * the GNU Public License, in which case the provisions of the GPL are
 * required INSTEAD OF the above restrictions.  (This clause is
 * necessary due to a potential bad interaction between the GPL and
 * the restrictions contained in a BSD-style copyright.)
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/* Written by Daniel Walsh <dwalsh@redhat.com> */

#include "selinux_utils.h"
#include <selinux/selinux.h>
#include <stdio.h>
#include <string.h>
#include <selinux/avc.h>
#include <libaudit.h>
#include <unistd.h>
#include <limits.h>

/* FD to send audit messages to */
static int audit_fd = -1;

/* log_callback stolen from dbus */
static int
log_callback (int type, const char *fmt, ...) 
{
  va_list ap;

  (void)type;

  va_start(ap, fmt);

  if (audit_fd >= 0)
  {
	  char buf[PATH_MAX*2];
    
	  vsnprintf(buf, sizeof(buf), fmt, ap);
	  audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
				     NULL, 0);
	  va_end(ap);
	  return 0;
  }
  
  vsyslog (LOG_USER | LOG_INFO, fmt, ap);
  va_end(ap);
  return 0;
}
int selinux_check_root(void) {
	int status = -1;
	security_context_t user_context;

	if (getuid() != 0) return 0;
	if (is_selinux_enabled() == 0) return 0;
	if ((status = getprevcon(&user_context)) < 0) return status;

	status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);

	freecon(user_context);

	return status;
}

void selinux_init(int fd) {
	if (is_selinux_enabled() > 0) {
		/* initialize audit log */

		audit_fd = fd;

		/* setup callbacks */
		selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
	}
}