A patch from Takeharu KATO to update/fix SE-Linux support.

3 files changed, 35 insertions, 28 deletions

diff --git a/loginutils/login.c b/loginutils/login.c
index 34095a6a7..5186e2369 100644
--- a/loginutils/login.c
+++ b/loginutils/login.c
@@ -17,10 +17,10 @@
 
 #include "busybox.h"
 #ifdef CONFIG_SELINUX
-#include <flask_util.h>
-#include <get_sid_list.h>
-#include <proc_secure.h>
-#include <fs_secure.h>
+#include <selinux/selinux.h>  /* for is_selinux_enabled()  */
+#include <selinux/get_context_list.h> /* for get_default_context() */
+#include <selinux/flask.h> /* for security class definitions  */
+#include <errno.h>
 #endif
 
 #ifdef CONFIG_FEATURE_U_W_TMP
@@ -79,8 +79,7 @@ extern int login_main(int argc, char **argv)
         char *opt_host = 0;
         int alarmstarted = 0;
 #ifdef CONFIG_SELINUX
-        int flask_enabled = is_flask_enabled();
-        security_id_t sid = 0, old_tty_sid, new_tty_sid;
+        security_context_t stat_sid = NULL, sid = NULL, old_tty_sid=NULL, new_tty_sid=NULL;
 #endif
 
         username[0]=0;
@@ -225,41 +224,45 @@ auth_ok:
 #ifdef CONFIG_FEATURE_U_W_TMP
         setutmp ( username, tty );
 #endif
+
+        if ( *tty != '/' )
+                snprintf ( full_tty, sizeof( full_tty ) - 1, "/dev/%s", tty);
+        else
+                safe_strncpy ( full_tty, tty, sizeof( full_tty ) - 1 );
+
 #ifdef CONFIG_SELINUX
-        if (flask_enabled)
+        if (is_selinux_enabled())
         {
                 struct stat st;
+                int rc;
 
-                if (get_default_sid(username, 0, &sid))
+                if (get_default_context(username, NULL, &sid))
                 {
                         fprintf(stderr, "Unable to get SID for %s\n", username);
                         exit(1);
                 }
-                if (stat_secure(tty, &st, &old_tty_sid))
+                rc = getfilecon(full_tty,&stat_sid);
+                freecon(stat_sid);
+                if ((rc<0) || (stat(full_tty, &st)<0))
                 {
-                        fprintf(stderr, "stat_secure(%.100s) failed: %.100s\n", tty, strerror(errno));
+                        fprintf(stderr, "stat_secure(%.100s) failed: %.100s\n", full_tty, strerror(errno));
                         return EXIT_FAILURE;
                 }
-                if (security_change_sid (sid, old_tty_sid, SECCLASS_CHR_FILE, &new_tty_sid) != 0)
+                if (security_compute_relabel (sid, old_tty_sid, SECCLASS_CHR_FILE, &new_tty_sid) != 0)
                 {
-                        fprintf(stderr, "security_change_sid(%.100s) failed: %.100s\n", tty, strerror(errno));
+                        fprintf(stderr, "security_change_sid(%.100s) failed: %.100s\n", full_tty, strerror(errno));
                         return EXIT_FAILURE;
                 }
-                if(chsid(tty, new_tty_sid) != 0)
+                if(setfilecon(full_tty, new_tty_sid) != 0)
                 {
-                        fprintf(stderr, "chsid(%.100s, %d) failed: %.100s\n", tty, new_tty_sid, strerror(errno));
+                        fprintf(stderr, "chsid(%.100s, %s) failed: %.100s\n", full_tty, new_tty_sid, strerror(errno));
                         return EXIT_FAILURE;
                 }
+                freecon(sid);
+                freecon(old_tty_sid);
+                freecon(new_tty_sid);
         }
-        else
-                sid = 0;
 #endif
-
-        if ( *tty != '/' )
-                snprintf ( full_tty, sizeof( full_tty ) - 1, "/dev/%s", tty);
-        else
-                safe_strncpy ( full_tty, tty, sizeof( full_tty ) - 1 );
-
         if ( !is_my_tty ( full_tty ))
                 syslog ( LOG_ERR, "unable to determine TTY name, got %s\n", full_tty );
 
@@ -279,11 +282,10 @@ auth_ok:
 
         if ( pw-> pw_uid == 0 )
                 syslog ( LOG_INFO, "root login %s\n", fromhost );
-        run_shell ( tmp, 1, 0, 0
 #ifdef CONFIG_SELINUX
-        , sid
+        set_current_security_context(sid);
 #endif
-         );     /* exec the shell finally. */
+        run_shell ( tmp, 1, 0, 0);      /* exec the shell finally. */
 
         return EXIT_FAILURE;
 }
diff --git a/loginutils/su.c b/loginutils/su.c
index ec0c16c7d..5f6140917 100644
--- a/loginutils/su.c
+++ b/loginutils/su.c
@@ -147,11 +147,10 @@ int su_main ( int argc, char **argv )
 
         change_identity ( pw );
         setup_environment ( opt_shell, opt_loginshell, !opt_preserve, pw );
-        run_shell ( opt_shell, opt_loginshell, opt_command, (const char**)opt_args
 #ifdef CONFIG_SELINUX
-        , 0
+       set_current_security_context(NULL);
 #endif
-        );
+        run_shell ( opt_shell, opt_loginshell, opt_command, (const char**)opt_args);
 
         return EXIT_FAILURE;
 }
diff --git a/loginutils/sulogin.c b/loginutils/sulogin.c
index f21b09571..a458b6ed7 100644
--- a/loginutils/sulogin.c
+++ b/loginutils/sulogin.c
@@ -153,6 +153,12 @@ extern int sulogin_main(int argc, char **argv)
         puts("Entering System Maintenance Mode\n");
         fflush(stdout);
         syslog(LOG_INFO, "System Maintenance Mode\n");
+
+#ifdef CONFIG_SELINUX
+        renew_current_security_context();
+#endif
+
         run_shell(pwent.pw_shell, 1, 0, 0);
+
         return (0);
 }