diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2010-07-22 17:01:25 -0400 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2010-07-23 05:12:13 +0200 |
| commit | 7a58bfa4aef88c9ddead6668d83640f762938e72 (patch) | |
| tree | 695ac07fc012006d000393fa3e43e71db46de9e2 /src/socket-util.c | |
| parent | 28322e1eb6507f2f40418e2dcdc6ee33e38ecee6 (diff) | |
socket: SELinux support for socket creation.
It seems to work on my machine.
/proc/1/fd/20 system_u:system_r:system_dbusd_t:s0
/proc/1/fd/21 system_u:system_r:avahi_t:s0
And the AVC's seem to have dissapeared when a confined app trys to
connect to dbus or avahi.
If you run with this patch and selinux-policy-3.8.8-3.fc14.noarch
You should be able to boot in enforcing mode.
Diffstat (limited to 'src/socket-util.c')
| -rw-r--r-- | src/socket-util.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/src/socket-util.c b/src/socket-util.c index 442abfe1af..3a00fcf43f 100644 --- a/src/socket-util.c +++ b/src/socket-util.c @@ -29,6 +29,7 @@ #include <net/if.h> #include <sys/types.h> #include <sys/stat.h> +#include <selinux/selinux.h> #include "macro.h" #include "util.h" @@ -305,7 +306,7 @@ int socket_address_listen( bool free_bind, mode_t directory_mode, mode_t socket_mode, - /* FIXME SELINUX: pass SELinux context object here */ + security_context_t scon, int *ret) { int r, fd, one; @@ -315,11 +316,19 @@ int socket_address_listen( if ((r = socket_address_verify(a)) < 0) return r; - /* FIXME SELINUX: The socket() here should be done with the - * right SELinux context set */ + if (setsockcreatecon(scon) < 0) { + log_error("Failed to set SELinux context (%s) on socket: %m", scon); + if (security_getenforce() == 1) + return -errno; + } + + fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0); + r = fd < 0 ? -errno : 0; + + setsockcreatecon(NULL); - if ((fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0)) < 0) - return -errno; + if (r < 0) + return r; if (socket_address_family(a) == AF_INET6 && only != SOCKET_ADDRESS_DEFAULT) { int flag = only == SOCKET_ADDRESS_IPV6_ONLY; |