aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--include/libbb.h2
-rw-r--r--libbb/update_passwd.c13
2 files changed, 12 insertions, 3 deletions
diff --git a/include/libbb.h b/include/libbb.h
index a42a2fba8..2e9ea46e2 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -81,8 +81,6 @@
81#if ENABLE_SELINUX 81#if ENABLE_SELINUX
82# include <selinux/selinux.h> 82# include <selinux/selinux.h>
83# include <selinux/context.h> 83# include <selinux/context.h>
84# include <selinux/flask.h>
85# include <selinux/av_permissions.h>
86#endif 84#endif
87#if ENABLE_FEATURE_UTMP 85#if ENABLE_FEATURE_UTMP
88# if defined __UCLIBC__ && ( \ 86# if defined __UCLIBC__ && ( \
diff --git a/libbb/update_passwd.c b/libbb/update_passwd.c
index a2004f480..6255af492 100644
--- a/libbb/update_passwd.c
+++ b/libbb/update_passwd.c
@@ -30,7 +30,18 @@ static void check_selinux_update_passwd(const char *username)
30 if (!seuser) 30 if (!seuser)
31 bb_error_msg_and_die("invalid context '%s'", context); 31 bb_error_msg_and_die("invalid context '%s'", context);
32 if (strcmp(seuser, username) != 0) { 32 if (strcmp(seuser, username) != 0) {
33 if (checkPasswdAccess(PASSWD__PASSWD) != 0) 33 security_class_t tclass;
34 access_vector_t av;
35
36 tclass = string_to_security_class("passwd");
37 if (tclass == 0)
38 goto die;
39 av = string_to_av_perm(tclass, "passwd");
40 if (av == 0)
41 goto die;
42
43 if (selinux_check_passwd_access(av) != 0)
44 die:
34 bb_error_msg_and_die("SELinux: access denied"); 45 bb_error_msg_and_die("SELinux: access denied");
35 } 46 }
36 if (ENABLE_FEATURE_CLEAN_UP) 47 if (ENABLE_FEATURE_CLEAN_UP)