diff options
-rw-r--r-- | include/libbb.h | 2 | ||||
-rw-r--r-- | libbb/update_passwd.c | 13 |
2 files changed, 12 insertions, 3 deletions
diff --git a/include/libbb.h b/include/libbb.h index a42a2fba8..2e9ea46e2 100644 --- a/include/libbb.h +++ b/include/libbb.h | |||
@@ -81,8 +81,6 @@ | |||
81 | #if ENABLE_SELINUX | 81 | #if ENABLE_SELINUX |
82 | # include <selinux/selinux.h> | 82 | # include <selinux/selinux.h> |
83 | # include <selinux/context.h> | 83 | # include <selinux/context.h> |
84 | # include <selinux/flask.h> | ||
85 | # include <selinux/av_permissions.h> | ||
86 | #endif | 84 | #endif |
87 | #if ENABLE_FEATURE_UTMP | 85 | #if ENABLE_FEATURE_UTMP |
88 | # if defined __UCLIBC__ && ( \ | 86 | # if defined __UCLIBC__ && ( \ |
diff --git a/libbb/update_passwd.c b/libbb/update_passwd.c index a2004f480..6255af492 100644 --- a/libbb/update_passwd.c +++ b/libbb/update_passwd.c | |||
@@ -30,7 +30,18 @@ static void check_selinux_update_passwd(const char *username) | |||
30 | if (!seuser) | 30 | if (!seuser) |
31 | bb_error_msg_and_die("invalid context '%s'", context); | 31 | bb_error_msg_and_die("invalid context '%s'", context); |
32 | if (strcmp(seuser, username) != 0) { | 32 | if (strcmp(seuser, username) != 0) { |
33 | if (checkPasswdAccess(PASSWD__PASSWD) != 0) | 33 | security_class_t tclass; |
34 | access_vector_t av; | ||
35 | |||
36 | tclass = string_to_security_class("passwd"); | ||
37 | if (tclass == 0) | ||
38 | goto die; | ||
39 | av = string_to_av_perm(tclass, "passwd"); | ||
40 | if (av == 0) | ||
41 | goto die; | ||
42 | |||
43 | if (selinux_check_passwd_access(av) != 0) | ||
44 | die: | ||
34 | bb_error_msg_and_die("SELinux: access denied"); | 45 | bb_error_msg_and_die("SELinux: access denied"); |
35 | } | 46 | } |
36 | if (ENABLE_FEATURE_CLEAN_UP) | 47 | if (ENABLE_FEATURE_CLEAN_UP) |