/*
* Copyright Red Hat, Inc., 2003,2004.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, and the entire permission notice in its entirety,
* including the disclaimer of warranties.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior
* written permission.
*
* ALTERNATIVELY, this product may be distributed under the terms of
* the GNU Public License, in which case the provisions of the GPL are
* required INSTEAD OF the above restrictions. (This clause is
* necessary due to a potential bad interaction between the GPL and
* the restrictions contained in a BSD-style copyright.)
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/* Written by Daniel Walsh <dwalsh@redhat.com> */
#include "selinux_utils.h"
#include <selinux/selinux.h>
#include <stdio.h>
#include <string.h>
#include <selinux/avc.h>
#include <libaudit.h>
#include <unistd.h>
#include <limits.h>
/* FD to send audit messages to */
static int audit_fd = -1;
/* log_callback stolen from dbus */
static int
log_callback (int type, const char *fmt, ...)
{
va_list ap;
(void)type;
va_start(ap, fmt);
if (audit_fd >= 0)
{
char buf[PATH_MAX*2];
vsnprintf(buf, sizeof(buf), fmt, ap);
audit_log_user_avc_message(audit_fd, AUDIT_USER_AVC, buf, NULL, NULL,
NULL, 0);
va_end(ap);
return 0;
}
vsyslog (LOG_USER | LOG_INFO, fmt, ap);
va_end(ap);
return 0;
}
int selinux_check_root(void) {
int status = -1;
security_context_t user_context;
if (getuid() != 0) return 0;
if (is_selinux_enabled() == 0) return 0;
if ((status = getprevcon(&user_context)) < 0) return status;
status = selinux_check_access(user_context, user_context, "passwd", "passwd", NULL);
freecon(user_context);
return status;
}
void selinux_init(int fd) {
if (is_selinux_enabled() > 0) {
/* initialize audit log */
audit_fd = fd;
/* setup callbacks */
selinux_set_callback(SELINUX_CB_LOG, (union selinux_callback) &log_callback);
}
}