diff options
author | djm <djm> | 2011-08-29 06:09:52 +0000 |
---|---|---|
committer | djm <djm> | 2011-08-29 06:09:52 +0000 |
commit | 38d3cf082839bbad3e0e26dad8edd2049b821fe5 (patch) | |
tree | dff497f535b4d7156c7c6cd027009be7e5ab2f03 /openbsd-compat | |
parent | 5131582302e2d89c716815c8b1437dc744d20f8c (diff) | |
download | openssh-38d3cf082839bbad3e0e26dad8edd2049b821fe5.tar.gz |
- (djm) [openbsd-compat/port-linux.c] Suppress logging when attempting
to switch SELinux context away from unconfined_t, based on patch from
Jan Chadima; bz#1919 ok dtucker@
Diffstat (limited to 'openbsd-compat')
-rw-r--r-- | openbsd-compat/port-linux.c | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index be763656..ea8dff40 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c @@ -1,4 +1,4 @@ -/* $Id: port-linux.c,v 1.15 2011/08/12 00:12:55 dtucker Exp $ */ +/* $Id: port-linux.c,v 1.16 2011/08/29 06:09:57 djm Exp $ */ /* * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> @@ -38,6 +38,10 @@ #include <selinux/flask.h> #include <selinux/get_context_list.h> +#ifndef SSH_SELINUX_UNCONFINED_TYPE +# define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:" +#endif + /* Wrapper around is_selinux_enabled() to log its return value once only */ int ssh_selinux_enabled(void) @@ -177,12 +181,13 @@ ssh_selinux_change_context(const char *newname) { int len, newlen; char *oldctx, *newctx, *cx; + void (*switchlog) (const char *fmt,...) = logit; if (!ssh_selinux_enabled()) return; if (getcon((security_context_t *)&oldctx) < 0) { - logit("%s: getcon failed with %s", __func__, strerror (errno)); + logit("%s: getcon failed with %s", __func__, strerror(errno)); return; } if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) == @@ -191,6 +196,14 @@ ssh_selinux_change_context(const char *newname) return; } + /* + * Check whether we are attempting to switch away from an unconfined + * security context. + */ + if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE, + sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0) + switchlog = debug3; + newlen = strlen(oldctx) + strlen(newname) + 1; newctx = xmalloc(newlen); len = cx - oldctx + 1; @@ -198,11 +211,11 @@ ssh_selinux_change_context(const char *newname) strlcpy(newctx + len, newname, newlen - len); if ((cx = index(cx + 1, ':'))) strlcat(newctx, cx, newlen); - debug3("%s: setting context from '%s' to '%s'", __func__, oldctx, - newctx); + debug3("%s: setting context from '%s' to '%s'", __func__, + oldctx, newctx); if (setcon(newctx) < 0) - logit("%s: setcon %s from %s failed with %s", __func__, newctx, - oldctx, strerror (errno)); + switchlog("%s: setcon %s from %s failed with %s", __func__, + newctx, oldctx, strerror(errno)); xfree(oldctx); xfree(newctx); } |