ahill/iproute2
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/iproute2/iproute2.git synced 2026-01-26 14:13:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

ip vrf: make ipvrf_exec SELinux-aware

Browse Source 
When using ip vrf and SELinux is enabled, make sure to set the exec file
context before calling cmd_exec.

This ensures that the command is executed with the right context,
falling back to the ifconfig_t context when needed.

Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
This commit is contained in:
Andrea Claudi 2023-08-23 19:30:02 +02:00 committed by David Ahern
parent e246ebc3b7
commit 0d0eeaa6cb
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/selinux.h
View File

@ -6,4 +6,5 @@ void freecon(char *context);
int getpidcon(pid_t pid, char **context);
int getfilecon(const char *path, char **context);
int security_get_initial_context(const char *name, char **context);
int setexecfilecon(const char *filename, const char *fallback_type);
#endif

6
ip/ipvrf.c
View File

@ -24,6 +24,7 @@
#include "utils.h"
#include "ip_common.h"
#include "bpf_util.h"
#include "selinux.h"
#define CGRP_PROC_FILE "/cgroup.procs"
@ -455,6 +456,11 @@ static int ipvrf_exec(int argc, char **argv)
return -1;
}
if (is_selinux_enabled() && setexecfilecon(argv[1], "ifconfig_t")) {
fprintf(stderr, "setexecfilecon for \"%s\" failed\n", argv[1]);
return -1;
}
return -cmd_exec(argv[1], argv + 1, !!batch_mode, do_switch, argv[0]);
}

5
lib/selinux.c
View File

@ -30,3 +30,8 @@ int security_get_initial_context(const char *name, char **context)
*context = NULL;
return -1;
}
int setexecfilecon(const char *filename, const char *fallback_type)
{
return -1;
}