Attachment 121381 Details for Bug 93920 – check MLS permissions when ListNames() is called

[patch] check MLS permissions when ListNames() is called

dbus-mls-names.patch (text/plain), 7.77 KB, created by David King on 2016-01-29 09:24:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David King

Created: 2016-01-29 09:24:27 UTC

Size: 7.77 KB

patch

obsolete

>From 8b74179ee31652bbaaf979777b9e829b426053ef Mon Sep 17 00:00:00 2001
>From: David King <dking@redhat.com>
>Date: Tue, 4 Nov 2014 10:10:36 +0000
>Subject: [PATCH] selinux: Check ListNames permissions with MLS
>
>https://bugzilla.redhat.com/show_bug.cgi?id=1118399
>---
> bus/driver.c  |  52 +++++++++++++++++++++++++
> bus/selinux.c | 123 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> bus/selinux.h |   5 +++
> 3 files changed, 180 insertions(+)
>
>diff --git a/bus/driver.c b/bus/driver.c
>index 574e0f3..20cc940 100644
>--- a/bus/driver.c
>+++ b/bus/driver.c
>@@ -379,6 +379,9 @@ bus_driver_handle_list_services (DBusConnection *connection,
>   char **services;
>   BusRegistry *registry;
>   int i;
>+#ifdef HAVE_SELINUX
>+  dbus_bool_t mls_enabled;
>+#endif
>   DBusMessageIter iter;
>   DBusMessageIter sub;
> 
>@@ -425,9 +428,58 @@ bus_driver_handle_list_services (DBusConnection *connection,
>       }
>   }
> 
>+#ifdef HAVE_SELINUX
>+  mls_enabled = bus_selinux_mls_enabled ();
>+#endif
>   i = 0;
>   while (i < len)
>     {
>+#ifdef HAVE_SELINUX
>+      if (mls_enabled)
>+        {
>+          const char *requester;
>+          BusService *service;
>+          DBusString str;
>+          DBusConnection *service_conn;
>+          DBusConnection *requester_conn;
>+
>+          requester = dbus_message_get_destination (reply);
>+          _dbus_string_init_const (&str, requester);
>+          service = bus_registry_lookup (registry, &str);
>+
>+          if (service == NULL)
>+            {
>+              _dbus_warn_check_failed ("service lookup failed: %s", requester);
>+              ++i;
>+              continue;
>+            }
>+          requester_conn = bus_service_get_primary_owners_connection (service);
>+          _dbus_string_init_const (&str, services[i]);
>+          service = bus_registry_lookup (registry, &str);
>+          if (service == NULL)
>+            {
>+              _dbus_warn_check_failed ("service lookup failed: %s", services[i]);
>+              ++i;
>+              continue;
>+            }
>+          service_conn = bus_service_get_primary_owners_connection (service);
>+
>+          if (!bus_selinux_allows_name (requester_conn, service_conn, error))
>+            {
>+              if (dbus_error_is_set (error) &&
>+                  dbus_error_has_name (error, DBUS_ERROR_NO_MEMORY))
>+                {
>+                  dbus_free_string_array (services);
>+                  dbus_message_unref (reply);
>+                  return FALSE;
>+                }
>+
>+              /* Skip any services which are disallowed by SELinux policy. */
>+              ++i;
>+              continue;
>+            }
>+        }
>+#endif
>       if (!dbus_message_iter_append_basic (&sub, DBUS_TYPE_STRING,
>                                            &services[i]))
>         {
>diff --git a/bus/selinux.c b/bus/selinux.c
>index 36287e9..6442b79 100644
>--- a/bus/selinux.c
>+++ b/bus/selinux.c
>@@ -63,6 +63,9 @@
> /* Store the value telling us if SELinux is enabled in the kernel. */
> static dbus_bool_t selinux_enabled = FALSE;
> 
>+/* Store the value telling us if SELinux with MLS is enabled in the kernel. */
>+static dbus_bool_t selinux_mls_enabled = FALSE;
>+
> /* Store an avc_entry_ref to speed AVC decisions. */
> static struct avc_entry_ref aeref;
> 
>@@ -289,6 +292,20 @@ bus_selinux_enabled (void)
> }
> 
> /**
>+ * Return whether or not SELinux with MLS support is enabled; must be
>+ * called after bus_selinux_init.
>+ */
>+dbus_bool_t
>+bus_selinux_mls_enabled (void)
>+{
>+#ifdef HAVE_SELINUX
>+  return selinux_mls_enabled;
>+#else
>+  return FALSE;
>+#endif /* HAVE_SELINUX */
>+}
>+
>+/**
>  * Do early initialization; determine whether SELinux is enabled.
>  */
> dbus_bool_t
>@@ -308,6 +325,16 @@ bus_selinux_pre_init (void)
>     }
> 
>   selinux_enabled = r != 0;
>+
>+  r = is_selinux_mls_enabled ();
>+  if (r < 0)
>+    {
>+      _dbus_warn ("Could not tell if SELinux MLS is enabled: %s\n",
>+                  _dbus_strerror (errno));
>+      return FALSE;
>+    }
>+
>+  selinux_mls_enabled = r != 0;
>   return TRUE;
> #else
>   return TRUE;
>@@ -724,6 +751,102 @@ bus_connection_read_selinux_context (DBusConnection     *connection,
> #endif /* HAVE_SELINUX */
> 
> /**
>+ * Check if SELinux security controls allow one connection to determine the
>+ * name of the other, taking into account MLS considerations.
>+ *
>+ * @param source the requester of the name.
>+ * @param destination the name being requested.
>+ * @returns whether the name should be visible by the source of the request
>+ */
>+dbus_bool_t
>+bus_selinux_allows_name (DBusConnection     *source,
>+                         DBusConnection     *destination,
>+                         DBusError          *error)
>+{
>+#ifdef HAVE_SELINUX
>+  int err;
>+  char *policy_type;
>+  unsigned long spid, tpid;
>+  BusSELinuxID *source_sid;
>+  BusSELinuxID *dest_sid;
>+  dbus_bool_t ret;
>+  dbus_bool_t string_alloced;
>+  DBusString auxdata;
>+
>+  if (!selinux_mls_enabled)
>+    return TRUE;
>+
>+  err = selinux_getpolicytype (&policy_type);
>+  if (err < 0)
>+    {
>+      dbus_set_error_const (error, DBUS_ERROR_IO_ERROR,
>+                            "Failed to get SELinux policy type");
>+      return FALSE;
>+    }
>+
>+  /* Only check against MLS policy if running under that policy. */
>+  if (strcmp (policy_type, "mls") != 0)
>+    {
>+      free (policy_type);
>+      return TRUE;
>+    }
>+
>+  free (policy_type);
>+
>+  _dbus_assert (source != NULL);
>+  _dbus_assert (destination != NULL);
>+
>+  if (!source || !dbus_connection_get_unix_process_id (source, &spid))
>+    spid = 0;
>+  if (!destination || !dbus_connection_get_unix_process_id (destination, &tpid))
>+    tpid = 0;
>+
>+  string_alloced = FALSE;
>+  if (!_dbus_string_init (&auxdata))
>+    goto oom;
>+  string_alloced = TRUE;
>+
>+  if (spid)
>+    {
>+      if (!_dbus_string_append (&auxdata, " spid="))
>+	goto oom;
>+
>+      if (!_dbus_string_append_uint (&auxdata, spid))
>+	goto oom;
>+    }
>+
>+  if (tpid)
>+    {
>+      if (!_dbus_string_append (&auxdata, " tpid="))
>+	goto oom;
>+
>+      if (!_dbus_string_append_uint (&auxdata, tpid))
>+	goto oom;
>+    }
>+
>+  source_sid = bus_connection_get_selinux_id (source);
>+  dest_sid = bus_connection_get_selinux_id (destination);
>+
>+  ret = bus_selinux_check (source_sid,
>+                           dest_sid,
>+                           SECCLASS_CONTEXT,
>+                           CONTEXT__CONTAINS,
>+                           &auxdata);
>+
>+  _dbus_string_free (&auxdata);
>+  return ret;
>+
>+ oom:
>+  if (string_alloced)
>+    _dbus_string_free (&auxdata);
>+  BUS_SET_OOM (error);
>+  return FALSE;
>+#else
>+  return TRUE;
>+#endif /* HAVE_SELINUX */
>+}
>+
>+/**
>  * Read the SELinux ID from the connection.
>  *
>  * @param connection the connection to read from
>diff --git a/bus/selinux.h b/bus/selinux.h
>index 3bab36d..fcaac5f 100644
>--- a/bus/selinux.h
>+++ b/bus/selinux.h
>@@ -32,6 +32,7 @@ dbus_bool_t bus_selinux_full_init(void);
> void        bus_selinux_shutdown (void);
> 
> dbus_bool_t bus_selinux_enabled  (void);
>+dbus_bool_t bus_selinux_mls_enabled (void);
> 
> void bus_selinux_id_ref    (BusSELinuxID *sid);
> void bus_selinux_id_unref  (BusSELinuxID *sid);
>@@ -54,6 +55,10 @@ dbus_bool_t bus_selinux_allows_acquire_service (DBusConnection *connection,
> 						const char     *service_name,
> 						DBusError      *error);
> 
>+dbus_bool_t bus_selinux_allows_name            (DBusConnection *source,
>+                                                DBusConnection *destination,
>+                                                DBusError      *error);
>+
> dbus_bool_t bus_selinux_allows_send            (DBusConnection *sender,
>                                                 DBusConnection *proposed_recipient,
> 						const char     *msgtype, /* Supplementary audit data */
>-- 
>2.1.0

Actions: View | Splinter Review

Attachments on bug 93920: 121381

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.