diff options
author | Darren Tucker <dtucker@zip.com.au> | 2009-10-24 15:04:12 +1100 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2009-10-24 15:04:12 +1100 |
commit | 4d6656b1030c2090f8769ce9cce0a9e5dd135945 (patch) | |
tree | 6cd9e06190cfbe4be752b82de995cb09d9303e9b /openbsd-compat/port-linux.c | |
parent | 6ac91a7c83a7343e9fdf24c2857b301b50e21a9c (diff) |
- (dtucker) [session.c openbsd-compat/port-linux.{c,h}] Bug #1637: if selinux
is enabled set the security context to "sftpd_t" before running the
internal sftp server Based on a patch from jchadima at redhat.
Diffstat (limited to 'openbsd-compat/port-linux.c')
-rw-r--r-- | openbsd-compat/port-linux.c | 37 |
1 files changed, 36 insertions, 1 deletions
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index ad262758..88c601e2 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c @@ -1,4 +1,4 @@ -/* $Id: port-linux.c,v 1.5 2008/03/26 20:27:21 dtucker Exp $ */ +/* $Id: port-linux.c,v 1.6 2009/10/24 04:04:13 dtucker Exp $ */ /* * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> @@ -29,6 +29,7 @@ #ifdef WITH_SELINUX #include "log.h" +#include "xmalloc.h" #include "port-linux.h" #include <selinux/selinux.h> @@ -168,4 +169,38 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) freecon(user_ctx); debug3("%s: done", __func__); } + +void +ssh_selinux_change_context(const char *newname) +{ + int len, newlen; + char *oldctx, *newctx, *cx; + + if (!ssh_selinux_enabled()) + return; + + if (getcon((security_context_t *)&oldctx) < 0) { + logit("%s: getcon failed with %s", __func__, strerror (errno)); + return; + } + if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) == + NULL) { + logit ("%s: unparseable context %s", __func__, oldctx); + return; + } + + newlen = strlen(oldctx) + strlen(newname) + 1; + newctx = xmalloc(newlen); + len = cx - oldctx + 1; + memcpy(newctx, oldctx, len); + strlcpy(newctx + len, newname, newlen - len); + if ((cx = index(cx + 1, ':'))) + strlcat(newctx, cx, newlen); + debug3("%s: setting context from '%s' to '%s'", __func__, oldctx, + newctx); + if (setcon(newctx) < 0) + logit("%s: setcon failed with %s", __func__, strerror (errno)); + xfree(oldctx); + xfree(newctx); +} #endif /* WITH_SELINUX */ |