diff options
Diffstat (limited to 'modules/pam_selinux/pam_selinux.c')
| -rw-r--r-- | modules/pam_selinux/pam_selinux.c | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/modules/pam_selinux/pam_selinux.c b/modules/pam_selinux/pam_selinux.c index 06c3ce65..e52e0fc4 100644 --- a/modules/pam_selinux/pam_selinux.c +++ b/modules/pam_selinux/pam_selinux.c @@ -393,7 +393,6 @@ free_module_data(module_data_t *data) freecon(data->prev_exec_context); if (data->exec_context != data->default_user_context) freecon(data->exec_context); - memset(data, 0, sizeof(*data)); free(data); } @@ -519,6 +518,7 @@ static int compute_tty_context(const pam_handle_t *pamh, module_data_t *data) { const char *tty = get_item(pamh, PAM_TTY); + security_class_t tclass; if (!tty || !*tty || !strcmp(tty, "ssh") || pam_str_skip_prefix(tty, "NODEV") != NULL) { @@ -552,11 +552,21 @@ compute_tty_context(const pam_handle_t *pamh, module_data_t *data) } pam_syslog(pamh, LOG_ERR, "Failed to get current context for %s: %m", data->tty_path); - return (security_getenforce() == 1) ? PAM_SESSION_ERR : PAM_SUCCESS; + return (security_getenforce() != 0) ? PAM_SESSION_ERR : PAM_SUCCESS; + } + + tclass = string_to_security_class("chr_file"); + if (tclass == 0) { + pam_syslog(pamh, LOG_ERR, "Failed to get chr_file security class"); + freecon(data->prev_tty_context); + data->prev_tty_context = NULL; + free(data->tty_path); + data->tty_path = NULL; + return (security_getenforce() != 0) ? PAM_SESSION_ERR : PAM_SUCCESS; } if (security_compute_relabel(data->exec_context, data->prev_tty_context, - string_to_security_class("chr_file"), &data->tty_context)) { + tclass, &data->tty_context)) { data->tty_context = NULL; pam_syslog(pamh, LOG_ERR, "Failed to compute new context for %s: %m", data->tty_path); @@ -564,7 +574,7 @@ compute_tty_context(const pam_handle_t *pamh, module_data_t *data) data->prev_tty_context = NULL; free(data->tty_path); data->tty_path = NULL; - return (security_getenforce() == 1) ? PAM_SESSION_ERR : PAM_SUCCESS; + return (security_getenforce() != 0) ? PAM_SESSION_ERR : PAM_SUCCESS; } return PAM_SUCCESS; @@ -595,7 +605,7 @@ restore_context(const pam_handle_t *pamh, const module_data_t *data, int debug) data->prev_exec_context ? data->prev_exec_context : ""); err |= set_exec_context(pamh, data->prev_exec_context); - if (err && security_getenforce() == 1) + if (err && security_getenforce() != 0) return PAM_SESSION_ERR; return PAM_SUCCESS; @@ -647,7 +657,7 @@ set_context(pam_handle_t *pamh, const module_data_t *data, } #endif - if (err && security_getenforce() == 1) + if (err && security_getenforce() != 0) return PAM_SESSION_ERR; return PAM_SUCCESS; @@ -706,7 +716,7 @@ create_context(pam_handle_t *pamh, int argc, const char **argv, if (!data->exec_context) { free_module_data(data); - return (security_getenforce() == 1) ? PAM_SESSION_ERR : PAM_SUCCESS; + return (security_getenforce() != 0) ? PAM_SESSION_ERR : PAM_SUCCESS; } if (ttys && (i = compute_tty_context(pamh, data)) != PAM_SUCCESS) { |