RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

seunshare: Try to use setcurrent before setexec 

If seunshare uses PR_SET_NO_NEW_PRIVS, which certain versions of
libcap-ng set, setexeccon will cause execve to fail.  This also
makes setting selinux context the very last action taken by
seunshare prior to exec, as it may otherwise cause things to fail.

Note that this won't work without adjusting the system policy to
allow this use of setcurrent.  This rule appears to work:

    allow unconfined_t sandbox_t:process dyntransition;

although a better rule would probably relax the unconfined_t
restriction.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
This commit is contained in:
Andy Lutomirski 2014-05-12 13:19:21 -04:00 committed by Stephen Smalley
parent de0795a12e
commit 74d27a9733
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
policycoreutils/sandbox/seunshare.c
View File

@ -826,17 +826,25 @@ int main(int argc, char **argv) {
goto childerr;
}
/* selinux context */
if (execcon && setexeccon(execcon) != 0) {
fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
goto childerr;
}
if (chdir(pwd->pw_dir)) {
perror(_("Failed to change dir to homedir"));
goto childerr;
}
setsid();
/* selinux context */
if (execcon) {
/* try dyntransition, since no_new_privs can interfere
* with setexeccon */
if (setcon(execcon) != 0) {
/* failed; fall back to setexeccon */
if (setexeccon(execcon) != 0) {
fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
goto childerr;
}
}
}
execv(argv[optind], argv + optind);
fprintf(stderr, _("Failed to execute command %s: %s\n"), argv[optind], strerror(errno));
childerr: