newrole: use pam session management services
PATCH 1/1 newrole: use pam session management services
This patch updates newrole to allow the use of pam session management services. Currently newrole only uses the authentication services of pam. Session management services are needed to allow pam_namespace to appropriately reconfigure polyinstantiated namespace for the new session being established with newrole. It applies on top of the 07/28/06 version of policycoreutils (policycoreutils-1.30.17-5) in rawhide.
---
newrole.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+)
newrole/newrole.c +62 -0
@@ -158,6 +158,7 @@ static char *build_new_range(char *newle#define SERVICE_NAME "newrole"/* the name of this program for PAM */ int authenticate_via_pam (const struct passwd *,const char *); +int namespace_via_pam (const struct passwd *);/* authenticate_via_pam() *
@@ -231,6 +232,58 @@ int authenticate_via_pam(const struct pa } /* authenticate_via_pam() */ +/* namespace_via_pam() +* +* in: pw - struct containing data from our user's line in +* the passwd file. +* out: nothing +* return: value condition +* ----- --------- +* 1 PAM thinks that the namespace setup was successful +* 0 otherwise +* +* This function uses PAM to setup namespace if polyinstantiated +* directories are configured on the system. +* +*/ + +int namespace_via_pam (const struct passwd *pw) +{ + +int result =0 ;/* set result to 0 (namespace not set) by default */ +int rc;/* pam return code */ +pam_handle_t *pam_handle;/* opaque handle used by all PAM functions */ + +/* This is a jump table of functions for PAM to use when it wants to * +* communicate with the user. We'll be using misc_conv(), which is * +* provided for us via pam_misc.h. */ +struct pam_conv pam_conversation = { + misc_conv, +NULL + }; + +/* Make `p_pam_handle' a valid PAM handle so we can use it when * +* calling PAM functions. */ + rc =pam_start (SERVICE_NAME , pw->pw_name, &pam_conversation, + &pam_handle); +if (rc !=PAM_SUCCESS ) { +fprintf (stderr,_ ("failed to initialize PAM\n" )); +exit (-1 ); + } + +/* Ask PAM to setup session for user running this program */ + rc =pam_open_session (pam_handle,0 ); +if (rc ==PAM_SUCCESS ) { + result =1 ;/* Namespace setup OK! */ + } + +/* We're done with PAM. Free `pam_handle'. */ +pam_end (pam_handle, rc); + +return (result); + +}/* namespace_via_pam() */ +#else /* else !USE_PAM */ /************************************************************************
@@ -897,6 +950,15 @@ int main(int argc, char *argv[]) }#endif freecon (old_context); + +#ifdef USE_PAM +if (!namespace_via_pam (pw)) { +fprintf (stderr,_ ("Namespace setup failed for %s\n" ), + pw->pw_name); +exit (-1 ); + } +#endif /* USE_PAM */ +execv (argv[optind -1 ], argv + optind -1 );/* If we reach here, then we failed to exec the new shell. */
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
On Fri, 2006-07-28 at 13:48 -0400, Janak Desai wrote:
<snip>
Quoted 12 lines
newrole/newrole.c +12
-0+int namespace_via_pam (const struct passwd *pw) +{ + +int result =0 ;/* set result to 0 (namespace not set) by default */ +int rc;/* pam return code */ +pam_handle_t *pam_handle;/* opaque handle used by all PAM functions */ + +/* This is a jump table of functions for PAM to use when it wants to * +* communicate with the user. We'll be using misc_conv(), which is * +* provided for us via pam_misc.h. */ +struct pam_conv pam_conversation = { + misc_conv,
newrole/newrole.c int authenticate_via_pam(const struct pa · line 271
Quoted 10 lines
newrole/newrole.c +10
-0+ NULL + }; + +/* Make `p_pam_handle' a valid PAM handle so we can use it when * +* calling PAM functions. */ + rc =pam_start (SERVICE_NAME , pw->pw_name, &pam_conversation, + &pam_handle); +if (rc !=PAM_SUCCESS ) { +fprintf (stderr,_ ("failed to initialize PAM\n" )); +exit (-1 );
Why not return an error code instead? 0 seems to be the error code for most of the code (strange as that is) - seems appropriate to return that.
newrole/newrole.c int authenticate_via_pam(const struct pa · line 279
Quoted 8 lines
newrole/newrole.c +8
-0+ } + +/* Ask PAM to setup session for user running this program */ + rc =pam_open_session (pam_handle,0 ); +if (rc ==PAM_SUCCESS ) { + result =1 ;/* Namespace setup OK! */ + } +
Looks like there is some code in policycoreutils that wants to use 1 for success and 0 for error - so you are following the convention. It is unfortunate as it doesn't match the bulk of the selinux code. Auditing and fixing it would be nice, but I don't think it is necessary.
newrole/newrole.c int authenticate_via_pam(const struct pa · line 283
Quoted 4 lines
newrole/newrole.c +4
-0+/* We're done with PAM. Free `pam_handle'. */ +pam_end (pam_handle, rc); + +return (result);
Most SELinux code thinks return is a keyword and not a function, though several of the policycoreutils programs think otherwise. Oh well - again, it would be nice to clean this up but it is probably low priority.
Karl
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 21 lines · Karl MacMillan
On Fri, 2006-07-28 at 13:48 -0400, Janak Desai wrote:
<snip>Quoted 18 lines
newrole/newrole.c +18
-0+int namespace_via_pam (const struct passwd *pw) +{ + +int result =0 ;/* set result to 0 (namespace not set) by default */ +int rc;/* pam return code */ +pam_handle_t *pam_handle;/* opaque handle used by all PAM functions */ + +/* This is a jump table of functions for PAM to use when it wants to * +* communicate with the user. We'll be using misc_conv(), which is * +* provided for us via pam_misc.h. */ +struct pam_conv pam_conversation = { + misc_conv, +NULL + }; + +/* Make `p_pam_handle' a valid PAM handle so we can use it when * +* calling PAM functions. */ + rc = pam_start(SERVICE_NAME, pw->pw_name, &pam_conversation,
Quoted 9 lines
newrole/newrole.c int authenticate_via_pam(const struct pa · line 271
Quoted 4 lines
newrole/newrole.c +4
-0+ &pam_handle); +if (rc !=PAM_SUCCESS ) { +fprintf (stderr,_ ("failed to initialize PAM\n" )); +exit (-1 );Why not return an error code instead? 0 seems to be the error code for most of the code (strange as that is) - seems appropriate to return that.
I was following the example of the other pam_star()t call in authenticate_via_pam(). Basically, I followed authenticate_via_pam logic, return codes, style etc when coding namespace_via_pam.
Quoted 24 lines
newrole/newrole.c int authenticate_via_pam(const struct pa · line 279
Quoted 8 lines
newrole/newrole.c +8
-0+ } + +/* Ask PAM to setup session for user running this program */ + rc =pam_open_session (pam_handle,0 ); +if (rc ==PAM_SUCCESS ) { + result =1 ;/* Namespace setup OK! */ + } +Looks like there is some code in policycoreutils that wants to use 1 for success and 0 for error - so you are following the convention. It is unfortunate as it doesn't match the bulk of the selinux code. Auditing and fixing it would be nice, but I don't think it is necessary.
newrole/newrole.c int authenticate_via_pam(const struct pa · line 283
Quoted 4 lines
newrole/newrole.c +4
-0+/* We're done with PAM. Free `pam_handle'. */ +pam_end (pam_handle, rc); + +return (result);Most SELinux code thinks return is a keyword and not a function, though several of the policycoreutils programs think otherwise. Oh well - again, it would be nice to clean this up but it is probably low priority.
Quoted 1 line
Karl
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.