lkml.org 
[lkml]   [2008]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectSMACK startproc patch
Sorry if i pollute the wrong list with my stuff. But SMACK does not seem 
to have it's own list and now lives in the kernel. Though this is
userspace related...

The smack howto mentions a not yet implemented smack option for
start-stop-daemon.
We mainly use startproc. So i made a patch which adds this functionality
to startproc.

It adds the option [-S LABEL] to startproc, which brings the called
process up with /proc/self/attr/current = LABEL.
I figured setting the security context should happen after things like
pidfiles where written. But this is certainly up for discussion.

This patch applies to killproc version 2.08.

Please enjoy and comment.

Regards
Tilman Baumann

--
Tilman Baumann
Software Developer
Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

p: +49 (0) 89-990157-0
f: +49 (0) 89-990157-11

Geschaeftsfuehrer: William K. Hite / Boris Nalbach
AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942
diff -Nur killproc-2.08.orig/startproc.c killproc-2.08/startproc.c
--- killproc-2.08.orig/startproc.c 2005-05-25 15:40:58.000000000 +0200
+++ killproc-2.08/startproc.c 2008-09-15 19:49:21.000000000 +0200
@@ -17,6 +17,7 @@
* 1998/05/06 Werner Fink: rework, added "-p" for pid files
* 1999/08/05 Werner Fink: added "-t" for time to sleep, reenable "-e"
* 2000/11/10 Werner Fink: LSB specs, logging
+ * 2008/09/15 Tilman Baumann <tilman.baumann@collax.com>: Smack labels
*/

#include "libinit.h"
@@ -26,12 +27,12 @@
#include <grp.h>

#define USAGE "Usage:\n"\
- "\t%s [-f] [+/-<prio>] [-s] [-u uid] [-g gid] [-v] [-l log_file|-q] /full/path/to/program\n"
+ "\t%s [-f] [+/-<prio>] [-s] [-u uid] [-g gid] [-v] [-l log_file|-q] [-S smacklabel] /full/path/to/program\n"
#define USAGE_SD "Usage:\n"\
"\t%s [-f] [-n +/-<prio>] /full/path/to/program\n"

static int do_fork(const char *name, char *argv[], const char* log_file,
- const int nicelvl, const int env, const char* root, unsigned short flags);
+ const int nicelvl, const int env, const char* root, unsigned short flags, const char *smack);

static int quiet = 1, supprmsg = 0, sess = 0, seconds = 0, force = 0, dialog = 0;
static struct passwd *user = NULL;
@@ -54,6 +55,7 @@
char *fullname = NULL, *basename = NULL;
char *log_file = NULL, *pid_file = NULL, *ignore_file = NULL;
char *root = NULL;
+ char *smack = NULL;
int nicelvl = 0, env = 0;
unsigned short flags = (DAEMON|PIDOF);

@@ -81,7 +83,7 @@
}

opterr = 0;
- while ((c = getopt(argc, argv, "+c:edp:l:hqvsu:g:t:n:fLi:")) != -1) { /* `+' is POSIX correct */
+ while ((c = getopt(argc, argv, "+c:edp:l:hqvsu:S:g:t:n:fLi:")) != -1) { /* `+' is POSIX correct */
switch (c) {
case 'v':
quiet = 0;
@@ -211,6 +213,12 @@
case 'h':
error(0, (strcmp("startproc", we_are) ? USAGE_SD : USAGE), we_are);
break;
+ case 'S':
+ if (optarg && optarg[0] != '/' && optarg[0] != '-') {
+ smack = optarg;
+ } else
+ error(LSB_WRGSYN,"Option -S requires a smack label string\n");
+ break;
default:
break;
}
@@ -310,7 +318,7 @@
exit(LSB_OK); /* Accordingly to LSB we have succeed. */

force:
- (void)do_fork(fullname, argv, log_file, nicelvl, env, root, flags);
+ (void)do_fork(fullname, argv, log_file, nicelvl, env, root, flags, smack);

/* Do we have started it? */

@@ -340,7 +348,7 @@

/* The core function */
static int do_fork(const char *inname, char *argv[], const char* log_file,
- const int nicelvl, const int env, const char* root, unsigned short flags)
+ const int nicelvl, const int env, const char* root, unsigned short flags, const char *smack)
{
extern char * we_are;
int tty = 255;
@@ -474,6 +482,16 @@
close(devnull);
}
}
+ if (smack) {
+ FILE *smack_current;
+ if ((smack_current = fopen("/proc/self/attr/current", "w")) == 0 ) {
+ error(LSB_PROOF," can not set smack label (missing capability?). %s\n", strerror(errno));
+ } else {
+ fprintf(smack_current, "%s", smack);
+ fclose(smack_current);
+ }
+
+ }
fflush(stdout);
fflush(stderr); /* flush stdout and especially stderr */
closelog();
\
 
 \ /
  Last update: 2008-09-25 19:01    [W:0.033 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site