From 2edbc2ab85b96fb01a3862db09df12f40d4382cd Mon Sep 17 00:00:00 2001
From: Denis Vlasenko <vda.linux@googlemail.com>
Date: Sat, 20 Oct 2007 02:00:49 +0000
Subject: ping: fix breakage from -I fix passwd: SELinux support by KaiGai
 Kohei <kaigai@ak.jp.nec.com>

---
 libbb/selinux_common.c | 14 ++++++++++++++
 libbb/update_passwd.c  | 29 +++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

(limited to 'libbb')

diff --git a/libbb/selinux_common.c b/libbb/selinux_common.c
index ff076f6f0..7478cc7b5 100644
--- a/libbb/selinux_common.c
+++ b/libbb/selinux_common.c
@@ -38,3 +38,17 @@ void setfscreatecon_or_die(security_context_t scontext)
 				"file creation context to %s", scontext);
 	}
 }
+
+void selinux_preserve_fcontext(int fdesc)
+{
+	security_context_t context;
+
+	if (fgetfilecon(fdesc, &context) < 0) {
+		if (errno == ENODATA || errno == ENOTSUP)
+			return;
+		bb_perror_msg_and_die("fgetfilecon failed");
+	}
+	setfscreatecon_or_die(context);
+	freecon(context);
+}
+
diff --git a/libbb/update_passwd.c b/libbb/update_passwd.c
index 8914b8b45..388adf81f 100644
--- a/libbb/update_passwd.c
+++ b/libbb/update_passwd.c
@@ -11,6 +11,31 @@
 
 #include "libbb.h"
 
+#if ENABLE_SELINUX
+static void check_selinux_update_passwd(const char *username)
+{
+	security_context_t context;
+	char *seuser;
+
+	if (getuid() != (uid_t)0 || is_selinux_enabled() == 0)
+		return;		/* No need to check */
+
+	if (getprevcon_raw(&context) < 0)
+		bb_perror_msg_and_die("getprevcon failed");
+	seuser = strtok(context, ":");
+	if (!seuser)
+		bb_error_msg_and_die("invalid context '%s'", context);
+	if (strcmp(seuser, username) != 0) {
+		if (checkPasswdAccess(PASSWD__PASSWD) != 0)
+			bb_error_msg_and_die("SELinux: access denied");
+	}
+	if (ENABLE_FEATURE_CLEAN_UP)
+		freecon(context);
+}
+#else
+#define check_selinux_update_passwd(username) ((void)0)
+#endif
+
 int update_passwd(const char *filename, const char *username,
 			const char *new_pw)
 {
@@ -27,6 +52,8 @@ int update_passwd(const char *filename, const char *username,
 	int cnt = 0;
 	int ret = -1; /* failure */
 
+	check_selinux_update_passwd(username);
+
 	/* New passwd file, "/etc/passwd+" for now */
 	fnamesfx = xasprintf("%s+", filename);
 	sfx_char = &fnamesfx[strlen(fnamesfx)-1];
@@ -38,6 +65,8 @@ int update_passwd(const char *filename, const char *username,
 		goto free_mem;
 	old_fd = fileno(old_fp);
 
+	selinux_preserve_fcontext(old_fd);
+
 	/* Try to create "/etc/passwd+". Wait if it exists. */
 	i = 30;
 	do {
-- 
cgit v1.2.3