Messages in this thread Patch in this message | | | Date | Thu, 25 Sep 2008 18:27:29 +0200 | From | Tilman Baumann <> | Subject | SMACK startproc patch |
| |
Sorry if i pollute the wrong list with my stuff. But SMACK does not seem to have it's own list and now lives in the kernel. Though this is userspace related...
The smack howto mentions a not yet implemented smack option for start-stop-daemon. We mainly use startproc. So i made a patch which adds this functionality to startproc.
It adds the option [-S LABEL] to startproc, which brings the called process up with /proc/self/attr/current = LABEL. I figured setting the security context should happen after things like pidfiles where written. But this is certainly up for discussion.
This patch applies to killproc version 2.08.
Please enjoy and comment.
Regards Tilman Baumann
-- Tilman Baumann Software Developer Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany
p: +49 (0) 89-990157-0 f: +49 (0) 89-990157-11
Geschaeftsfuehrer: William K. Hite / Boris Nalbach AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942 diff -Nur killproc-2.08.orig/startproc.c killproc-2.08/startproc.c --- killproc-2.08.orig/startproc.c 2005-05-25 15:40:58.000000000 +0200 +++ killproc-2.08/startproc.c 2008-09-15 19:49:21.000000000 +0200 @@ -17,6 +17,7 @@ * 1998/05/06 Werner Fink: rework, added "-p" for pid files * 1999/08/05 Werner Fink: added "-t" for time to sleep, reenable "-e" * 2000/11/10 Werner Fink: LSB specs, logging + * 2008/09/15 Tilman Baumann <tilman.baumann@collax.com>: Smack labels */ #include "libinit.h" @@ -26,12 +27,12 @@ #include <grp.h> #define USAGE "Usage:\n"\ - "\t%s [-f] [+/-<prio>] [-s] [-u uid] [-g gid] [-v] [-l log_file|-q] /full/path/to/program\n" + "\t%s [-f] [+/-<prio>] [-s] [-u uid] [-g gid] [-v] [-l log_file|-q] [-S smacklabel] /full/path/to/program\n" #define USAGE_SD "Usage:\n"\ "\t%s [-f] [-n +/-<prio>] /full/path/to/program\n" static int do_fork(const char *name, char *argv[], const char* log_file, - const int nicelvl, const int env, const char* root, unsigned short flags); + const int nicelvl, const int env, const char* root, unsigned short flags, const char *smack); static int quiet = 1, supprmsg = 0, sess = 0, seconds = 0, force = 0, dialog = 0; static struct passwd *user = NULL; @@ -54,6 +55,7 @@ char *fullname = NULL, *basename = NULL; char *log_file = NULL, *pid_file = NULL, *ignore_file = NULL; char *root = NULL; + char *smack = NULL; int nicelvl = 0, env = 0; unsigned short flags = (DAEMON|PIDOF); @@ -81,7 +83,7 @@ } opterr = 0; - while ((c = getopt(argc, argv, "+c:edp:l:hqvsu:g:t:n:fLi:")) != -1) { /* `+' is POSIX correct */ + while ((c = getopt(argc, argv, "+c:edp:l:hqvsu:S:g:t:n:fLi:")) != -1) { /* `+' is POSIX correct */ switch (c) { case 'v': quiet = 0; @@ -211,6 +213,12 @@ case 'h': error(0, (strcmp("startproc", we_are) ? USAGE_SD : USAGE), we_are); break; + case 'S': + if (optarg && optarg[0] != '/' && optarg[0] != '-') { + smack = optarg; + } else + error(LSB_WRGSYN,"Option -S requires a smack label string\n"); + break; default: break; } @@ -310,7 +318,7 @@ exit(LSB_OK); /* Accordingly to LSB we have succeed. */ force: - (void)do_fork(fullname, argv, log_file, nicelvl, env, root, flags); + (void)do_fork(fullname, argv, log_file, nicelvl, env, root, flags, smack); /* Do we have started it? */ @@ -340,7 +348,7 @@ /* The core function */ static int do_fork(const char *inname, char *argv[], const char* log_file, - const int nicelvl, const int env, const char* root, unsigned short flags) + const int nicelvl, const int env, const char* root, unsigned short flags, const char *smack) { extern char * we_are; int tty = 255; @@ -474,6 +482,16 @@ close(devnull); } } + if (smack) { + FILE *smack_current; + if ((smack_current = fopen("/proc/self/attr/current", "w")) == 0 ) { + error(LSB_PROOF," can not set smack label (missing capability?). %s\n", strerror(errno)); + } else { + fprintf(smack_current, "%s", smack); + fclose(smack_current); + } + + } fflush(stdout); fflush(stderr); /* flush stdout and especially stderr */ closelog(); | |