Date: Wed, 5 Jan 2005 20:23:44 GMT From: Andrew Reisse <areisse@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 68339 for review Message-ID: <200501052023.j05KNiAQ032355@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=68339 Change 68339 by areisse@areisse_tislabs on 2005/01/05 20:23:42 Relabel terminals in newrole. Affected files ... .. //depot/projects/trustedbsd/sebsd/usr.sbin/sebsd_newrole/sebsd_newrole.c#3 edit Differences ... ==== //depot/projects/trustedbsd/sebsd/usr.sbin/sebsd_newrole/sebsd_newrole.c#3 (text+ko) ==== @@ -25,6 +25,7 @@ #include <security/pam_appl.h> #include <security/openpam.h> +#include <security/sebsd/flask.h> #include <sys/mac.h> #include <sebsd.h> @@ -98,7 +99,8 @@ context_t context; struct passwd *pw; struct passwd pw_copy; - mac_t execlabel; + mac_t execlabel, oldtty, newtty; + char *ttyn; if (!sebsd_enabled()) { fprintf(stderr, "Sorry, sebsd_newrole may only be used when " @@ -201,6 +203,37 @@ exit(1); } + /* + * Handle terminal labelling. + */ + ttyn = ttyname(STDIN_FILENO); + if (ttyn && *ttyn) { + char *oldttys, *newttys, *newttyslabel; + + if (mac_prepare(&oldtty, "sebsd") != 0 || + mac_get_file(ttyn, oldtty) != 0 || + mac_to_text(oldtty, &oldttys) != 0) { + perror(ttyn); + exit(1); + } + if (security_change_context(new_context, oldttys + + sizeof("sebsd/") - 1, SECCLASS_CHR_FILE, + &newttys) != 0 || + asprintf(&newttyslabel, "sebsd/%s", newttys) == -1) { + fprintf(stderr, + "Unable to determine new terminal label for %s\n", + ttyn); + exit(1); + } + free(oldttys); + + if (mac_from_text(&newtty, newttyslabel) != 0 || + mac_set_file(ttyn, newtty) != 0) { + perror(ttyn); + exit(1); + } + } + if (asprintf(&labeltext, "sebsd/%s", new_context) == -1 || mac_from_text(&execlabel, labeltext) != 0) { fprintf(stderr, "Error, failed to create new context\n"); @@ -208,6 +241,15 @@ } free(labeltext); + /* + * restore the old terminal label when the shell exits. + */ + if (ttyn && *ttyn && fork()) { + wait(); + mac_set_file(ttyn, oldtty); + exit(0); + } + if (argc == 0) { char *shell_argv[2];
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200501052023.j05KNiAQ032355>