1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
--- sysvinit-2.85/src/init.c.selinux 2005-10-14 14:16:24.000000000 -0400
+++ sysvinit-2.85/src/init.c 2005-10-14 14:16:24.000000000 -0400
@@ -48,6 +48,8 @@
#include <stdarg.h>
#include <sys/syslog.h>
#include <sys/time.h>
+#include <selinux/selinux.h>
+
#ifdef __i386__
# if (__GLIBC__ >= 2)
@@ -2513,6 +2515,7 @@
char *p;
int f;
int isinit;
+ int enforce = 0;
/* Get my own name */
if ((p = strrchr(argv[0], '/')) != NULL)
@@ -2576,6 +2579,20 @@
maxproclen += strlen(argv[f]) + 1;
}
+ if (getenv("SELINUX_INIT") == NULL) {
+ putenv("SELINUX_INIT=YES");
+ if (selinux_init_load_policy(&enforce) == 0 ) {
+ execv(myname, argv);
+ } else {
+ if (enforce > 0) {
+ /* SELinux in enforcing mode but load_policy failed */
+ /* At this point, we probably can't open /dev/console, so log() won't work */
+ initlog(L_VB,"Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.");
+ exit(1);
+ }
+ }
+ }
+
/* Start booting. */
argv0 = argv[0];
argv[1] = NULL;
--- sysvinit-2.85/src/Makefile.selinux 2005-10-14 14:16:24.000000000 -0400
+++ sysvinit-2.85/src/Makefile 2005-10-14 14:16:24.000000000 -0400
@@ -32,7 +32,7 @@
all: $(BIN) $(SBIN) $(USRBIN)
init: init.o init_utmp.o
- $(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o
+ $(CC) $(LDFLAGS) $(STATIC) -o $@ init.o init_utmp.o -lsepol -lselinux
halt: halt.o ifdown.o hddown.o utmp.o reboot.h
$(CC) $(LDFLAGS) -o $@ halt.o ifdown.o hddown.o utmp.o
@@ -50,7 +50,7 @@
$(CC) $(LDFLAGS) -o $@ runlevel.o
sulogin: sulogin.o
- $(CC) $(LDFLAGS) $(STATIC) -o $@ sulogin.o $(LCRYPT)
+ $(CC) $(LDFLAGS) $(STATIC) -o $@ sulogin.o $(LCRYPT) -lselinux
wall: dowall.o wall.o
$(CC) $(LDFLAGS) -o $@ dowall.o wall.o
--- sysvinit-2.85/src/sulogin.c.selinux 2005-10-14 14:16:24.000000000 -0400
+++ sysvinit-2.85/src/sulogin.c 2005-10-14 14:18:42.000000000 -0400
@@ -28,6 +28,8 @@
# include <crypt.h>
#endif
+#include <selinux/selinux.h>
+#include <selinux/get_context_list.h>
#define CHECK_DES 1
#define CHECK_MD5 1
@@ -332,6 +335,19 @@
signal(SIGINT, SIG_DFL);
signal(SIGTSTP, SIG_DFL);
signal(SIGQUIT, SIG_DFL);
+ if (is_selinux_enabled > 0) {
+ security_context_t scon=NULL;
+ char *seuser=NULL;
+ char *level=NULL;
+ if (getseuserbyname("root", &seuser, &level) == 0)
+ if (get_default_context_with_level(seuser, level, 0, &scon) > 0) {
+ if (setexeccon(scon) != 0)
+ fprintf(stderr, "setexeccon failed\n");
+ freecon(scon);
+ }
+ free(seuser);
+ free(level);
+ }
execl(sushell, shell, NULL);
perror(sushell);
|
GitWeb