diff options
Diffstat (limited to 'sys-apps/sysvinit/files/2.86-selinux.patch')
| -rw-r--r-- | sys-apps/sysvinit/files/2.86-selinux.patch | 219 |
1 files changed, 219 insertions, 0 deletions
diff --git a/sys-apps/sysvinit/files/2.86-selinux.patch b/sys-apps/sysvinit/files/2.86-selinux.patch new file mode 100644 index 000000000000..9bda14ef63a7 --- /dev/null +++ b/sys-apps/sysvinit/files/2.86-selinux.patch @@ -0,0 +1,219 @@ +--- sysvinit-2.85/src/Makefile.selinux 2004-06-09 15:28:47.439412648 -0400 ++++ sysvinit-2.85/src/Makefile 2004-06-09 15:28:47.517400792 -0400 +@@ -12,2 +12,4 @@ + STATIC = ++CFLAGS += -DWITH_SELINUX ++LDFLAGS += -lselinux + +--- sysvinit-2.85/src/init.c.selinux 2004-06-09 15:28:47.478406720 -0400 ++++ sysvinit-2.85/src/init.c 2004-06-09 15:29:03.208015456 -0400 +@@ -48,6 +48,10 @@ + #include <stdarg.h> + #include <sys/syslog.h> + #include <sys/time.h> ++#include <sys/mman.h> ++#include <selinux/selinux.h> ++#include <sys/mount.h> ++ + + #ifdef __i386__ + # if (__GLIBC__ >= 2) +@@ -103,6 +107,7 @@ + int dfl_level = 0; /* Default runlevel */ + sig_atomic_t got_cont = 0; /* Set if we received the SIGCONT signal */ + sig_atomic_t got_signals; /* Set if we received a signal. */ ++int enforcing = -1; /* SELinux enforcing mode */ + int emerg_shell = 0; /* Start emergency shell? */ + int wrote_wtmp_reboot = 1; /* Set when we wrote the reboot record */ + int wrote_utmp_reboot = 1; /* Set when we wrote the reboot record */ +@@ -187,6 +192,130 @@ + {NULL,0} + }; + ++/* Mount point for selinuxfs. */ ++#define SELINUXMNT "/selinux/" ++ ++static int load_policy(int *enforce) ++{ ++ int fd=-1,ret=-1; ++ int rc=0; ++ struct stat sb; ++ void *map; ++ char policy_file[PATH_MAX]; ++ int policy_version=0; ++ extern char *selinux_mnt; ++ FILE *cfg; ++ char buf[4096]; ++ int seconfig = -2; ++ ++ selinux_getenforcemode(&seconfig); ++ ++ mount("none", "/proc", "proc", 0, 0); ++ cfg = fopen("/proc/cmdline","r"); ++ if (cfg) { ++ char *tmp; ++ if (fgets(buf,4096,cfg) && (tmp = strstr(buf,"enforcing="))) { ++ if (tmp == buf || isspace(*(tmp-1))) { ++ enforcing=atoi(tmp+10); ++ } ++ } ++ fclose(cfg); ++ } ++#define MNT_DETACH 2 ++ umount2("/proc",MNT_DETACH); ++ ++ if (enforcing >=0) ++ *enforce = enforcing; ++ else if (seconfig == 1) ++ *enforce = 1; ++ ++ if (mount("none", SELINUXMNT, "selinuxfs", 0, 0) < 0) { ++ if (errno == ENODEV) { ++ log(L_VB, "SELinux not supported by kernel: %s\n",SELINUXMNT,strerror(errno)); ++ *enforce = 0; ++ } else { ++ log(L_VB, "Failed to mount %s: %s\n",SELINUXMNT,strerror(errno)); ++ } ++ return ret; ++ } ++ ++ selinux_mnt = SELINUXMNT; /* set manually since we mounted it */ ++ ++ policy_version=security_policyvers(); ++ if (policy_version < 0) { ++ log(L_VB, "Can't get policy version: %s\n", strerror(errno)); ++ goto UMOUNT; ++ } ++ ++ rc = security_getenforce(); ++ if (rc < 0) { ++ log(L_VB, "Can't get SELinux enforcement flag: %s\n", strerror(errno)); ++ goto UMOUNT; ++ } ++ if (enforcing >= 0) { ++ *enforce = enforcing; ++ } else if (seconfig == -1) { ++ *enforce = 0; ++ rc = security_disable(); ++ if (rc == 0) umount(SELINUXMNT); ++ if (rc < 0) { ++ rc = security_setenforce(0); ++ if (rc < 0) { ++ log(L_VB, "Can't disable SELinux: %s\n", strerror(errno)); ++ goto UMOUNT; ++ } ++ } ++ ret = 0; ++ goto UMOUNT; ++ } else if (seconfig >= 0) { ++ *enforce = seconfig; ++ rc = security_setenforce(seconfig); ++ if (rc < 0) { ++ log(L_VB, "Can't set SELinux enforcement flag: %s\n", strerror(errno)); ++ goto UMOUNT; ++ } ++ } ++ ++ snprintf(policy_file,sizeof(policy_file),"%s.%d",selinux_binary_policy_path(),policy_version); ++ fd = open(policy_file, O_RDONLY); ++ if (fd < 0) { ++ /* Check previous version to see if old policy is available ++ */ ++ snprintf(policy_file,sizeof(policy_file),"%s.%d",selinux_binary_policy_path(),policy_version-1); ++ fd = open(policy_file, O_RDONLY); ++ if (fd < 0) { ++ log(L_VB, "Can't open '%s.%d': %s\n", ++ selinux_binary_policy_path(),policy_version,strerror(errno)); ++ goto UMOUNT; ++ } ++ } ++ ++ if (fstat(fd, &sb) < 0) { ++ log(L_VB, "Can't stat '%s': %s\n", ++ policy_file, strerror(errno)); ++ goto UMOUNT; ++ } ++ ++ map = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, fd, 0); ++ if (map == MAP_FAILED) { ++ log(L_VB, "Can't map '%s': %s\n", ++ policy_file, strerror(errno)); ++ goto UMOUNT; ++ } ++ log(L_VB, "Loading security policy\n"); ++ ret=security_load_policy(map, sb.st_size); ++ if (ret < 0) { ++ log(L_VB, "security_load_policy failed\n"); ++ } ++ ++UMOUNT: ++ /*umount(SELINUXMNT); */ ++ if ( fd >= 0) { ++ close(fd); ++ } ++ return(ret); ++} ++ + /* + * Sleep a number of seconds. + * +@@ -2513,6 +2642,7 @@ + char *p; + int f; + int isinit; ++ int enforce = 0; + + /* Get my own name */ + if ((p = strrchr(argv[0], '/')) != NULL) +@@ -2576,6 +2706,20 @@ + maxproclen += strlen(argv[f]) + 1; + } + ++ if (getenv("SELINUX_INIT") == NULL) { ++ putenv("SELINUX_INIT=YES"); ++ if (load_policy(&enforce) == 0 ) { ++ execv(myname, argv); ++ } else { ++ if (enforce > 0) { ++ /* SELinux in enforcing mode but load_policy failed */ ++ /* At this point, we probably can't open /dev/console, so log() won't work */ ++ printf("Enforcing mode requested but no policy loaded. Halting now.\n"); ++ exit(1); ++ } ++ } ++ } ++ + /* Start booting. */ + argv0 = argv[0]; + argv[1] = NULL; +--- sysvinit-2.85/src/sulogin.c.selinux 2004-06-09 15:28:47.321430584 -0400 ++++ sysvinit-2.85/src/sulogin.c 2004-06-09 15:28:47.523399880 -0400 +@@ -28,7 +28,10 @@ + #if defined(__GLIBC__) + # include <crypt.h> + #endif +- ++#ifdef WITH_SELINUX ++#include <selinux/selinux.h> ++#include <selinux/get_context_list.h> ++#endif + #define CHECK_DES 1 + #define CHECK_MD5 1 + +@@ -332,6 +335,16 @@ + signal(SIGINT, SIG_DFL); + signal(SIGTSTP, SIG_DFL); + signal(SIGQUIT, SIG_DFL); ++#ifdef WITH_SELINUX ++ if (is_selinux_enabled > 0) { ++ security_context_t* contextlist=NULL; ++ if (get_ordered_context_list("root", 0, &contextlist) > 0) { ++ if (setexeccon(contextlist[0]) != 0) ++ fprintf(stderr, "setexeccon faile\n"); ++ freeconary(contextlist); ++ } ++ } ++#endif + execl(sushell, shell, NULL); + perror(sushell); + |