133 lines
3.8 KiB
Diff
133 lines
3.8 KiB
Diff
--- at-3.1.8/configure.in.selinux 2004-04-15 13:57:37.000000000 -0400
|
|
+++ at-3.1.8/configure.in 2004-04-15 13:57:37.000000000 -0400
|
|
@@ -320,4 +320,12 @@
|
|
)
|
|
AC_SUBST(DAEMON_GROUPNAME)
|
|
|
|
+AC_ARG_WITH(selinux,
|
|
+[ --with-selinux Define to run with selinux],
|
|
+AC_DEFINE(WITH_SELINUX),
|
|
+)
|
|
+AC_CHECK_LIB(selinux, is_selinux_enabled, SELINUXLIB=-lselinux)
|
|
+AC_SUBST(SELINUXLIB)
|
|
+AC_SUBST(WITH_SELINUX)
|
|
+
|
|
AC_OUTPUT(Makefile atrun atd.8 atrun.8 at.1 batch)
|
|
--- at-3.1.8/atd.c.selinux 2004-04-15 13:57:37.000000000 -0400
|
|
+++ at-3.1.8/atd.c 2004-05-05 13:31:31.616622776 -0400
|
|
@@ -85,6 +85,14 @@
|
|
#include <syslog.h>
|
|
#endif
|
|
|
|
+#ifdef WITH_SELINUX
|
|
+#include <selinux/selinux.h>
|
|
+#include <selinux/get_context_list.h>
|
|
+int selinux_enabled=0;
|
|
+#include <selinux/flask.h>
|
|
+#include <selinux/av_permissions.h>
|
|
+#endif
|
|
+
|
|
/* Local headers */
|
|
|
|
#include "privs.h"
|
|
@@ -438,6 +446,47 @@
|
|
|
|
chdir("/");
|
|
|
|
+#ifdef WITH_SELINUX
|
|
+ if (selinux_enabled>0) {
|
|
+ security_context_t user_context=NULL;
|
|
+ security_context_t file_context=NULL;
|
|
+ int retval=0;
|
|
+ struct av_decision avd;
|
|
+
|
|
+ if (get_default_context(pentry->pw_name, NULL, &user_context))
|
|
+ perr("execle: couldn't get security context for user %s\n", pentry->pw_name);
|
|
+ /*
|
|
+ * Since crontab files are not directly executed,
|
|
+ * crond must ensure that the crontab file has
|
|
+ * a context that is appropriate for the context of
|
|
+ * the user cron job. It performs an entrypoint
|
|
+ * permission check for this purpose.
|
|
+ */
|
|
+ if (fgetfilecon(STDIN_FILENO, &file_context) < 0)
|
|
+ perr("fgetfilecon FAILED %s", filename);
|
|
+
|
|
+ retval = security_compute_av(user_context,
|
|
+ file_context,
|
|
+ SECCLASS_FILE,
|
|
+ FILE__ENTRYPOINT,
|
|
+ &avd);
|
|
+ freecon(file_context);
|
|
+ if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
|
|
+ if (security_getenforce()==1)
|
|
+ perr("Not allowed to set exec context to %s for user %s\n", user_context,pentry->pw_name);
|
|
+ }
|
|
+
|
|
+ if (setexeccon(user_context) < 0) {
|
|
+ if (security_getenforce()==1) {
|
|
+ perr("Could not set exec context to %s for user %s\n", user_context,pentry->pw_name);
|
|
+ } else {
|
|
+ syslog(LOG_ERR, "Could not set exec context to %s for user %s\n", user_context,pentry->pw_name);
|
|
+ }
|
|
+ }
|
|
+ freecon(user_context);
|
|
+ }
|
|
+#endif
|
|
+
|
|
if (execle("/bin/sh", "sh", (char *) NULL, nenvp) != 0)
|
|
perr("Exec failed for /bin/sh");
|
|
|
|
@@ -454,6 +503,13 @@
|
|
*/
|
|
waitpid(pid, (int *) NULL, 0);
|
|
|
|
+#ifdef WITH_SELINUX
|
|
+ if (selinux_enabled>0) {
|
|
+ if (setexeccon(NULL) < 0) {
|
|
+ perr("Could not resset exec context for user %s\n", pentry->pw_name);
|
|
+ }
|
|
+ }
|
|
+#endif
|
|
/* Send mail. Unlink the output file after opening it, so it
|
|
* doesn't hang around after the run (if we are to send mail)
|
|
*/
|
|
@@ -693,6 +749,9 @@
|
|
struct passwd *pwe;
|
|
struct group *ge;
|
|
|
|
+#ifdef WITH_SELINUX
|
|
+ selinux_enabled=is_selinux_enabled();
|
|
+#endif
|
|
/* We don't need root privileges all the time; running under uid and gid
|
|
* daemon is fine.
|
|
*/
|
|
--- at-3.1.8/config.h.in.selinux 1997-05-13 08:41:28.000000000 -0400
|
|
+++ at-3.1.8/config.h.in 2004-04-15 13:57:37.000000000 -0400
|
|
@@ -184,3 +184,6 @@
|
|
#undef DEFAULT_BATCH_QUEUE
|
|
|
|
#undef HAVE_ATTRIBUTE_NORETURN
|
|
+
|
|
+/* Define if you are building with_selinux */
|
|
+#undef WITH_SELINUX
|
|
--- at-3.1.8/Makefile.in.selinux 2004-04-15 13:57:37.000000000 -0400
|
|
+++ at-3.1.8/Makefile.in 2004-04-15 13:57:37.000000000 -0400
|
|
@@ -27,6 +27,7 @@
|
|
YACC = @YACC@
|
|
LEX = @LEX@
|
|
LEXLIB = @LEXLIB@
|
|
+SELINUXLIB = @SELINUXLIB@
|
|
|
|
CC = @CC@
|
|
CFLAGS = @CFLAGS@
|
|
@@ -74,7 +75,7 @@
|
|
$(LN_S) -f at atrm
|
|
|
|
atd: $(RUNOBJECTS)
|
|
- $(CC) $(CFLAGS) -o atd $(RUNOBJECTS) $(LIBS)
|
|
+ $(CC) $(CFLAGS) -o atd $(RUNOBJECTS) $(LIBS) $(SELINUXLIB)
|
|
|
|
y.tab.c y.tab.h: parsetime.y
|
|
$(YACC) -d parsetime.y
|