diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2004-09-17 00:04:18 +0000 |
|---|---|---|
| committer | Ulrich Drepper <drepper@redhat.com> | 2004-09-17 00:04:18 +0000 |
| commit | 74a30a5851087f40ff53f2716374c8870cd4a48a (patch) | |
| tree | 2ac1d833b6114746a43a48d3113ebf8d1df4b571 /nscd/connections.c | |
| parent | 2fff3d93b552dbddc406c41786ecfd0a1074b564 (diff) | |
| download | glibc-74a30a5851087f40ff53f2716374c8870cd4a48a.tar.gz glibc-74a30a5851087f40ff53f2716374c8870cd4a48a.tar.xz glibc-74a30a5851087f40ff53f2716374c8870cd4a48a.zip | |
Update.
2004-09-16 Ulrich Drepper <drepper@redhat.com> * configure.in: Add test for required SELinux features. * config.make.in: Add have-selinux entry. * config.h.in: Add HAVE_SELINUX entry. * nscd/Makefile (nscd-modules): Add selinux. (CFLAGS-selinux.c): Add -fpie. Define selinux-LIBS and use in link line. * nscd/connections.c (handle_request): Check access SELinux permissions before processing request. * nscd/nscd.c (main): Initialize selinux_enabled and stop avc thread. * nscd/nscd_stat.c: Transmit and print AVC statistics. * nscd/selinux.c: New file. * nscd/selinux.h: New file. 2004-09-16 Jakub Jelinek <jakub@redhat.com> * nscd/nscd_helper.c (__nscd_unmap, get_mapping): Use __munmap instead of munmap. * nscd/Makefile (CFLAGS-aicache.c): Set to -fpie. 2004-09-16 Thorsten Kukuk <kukuk@suse.de> * sysdeps/posix/getaddrinfo.c (gaih_inet): Check __nss_not_use_nscd_hosts variable if nscd should be used or not. 2004-09-16 Ulrich Drepper <drepper@redhat.com> * nscd/nscd_proto.h: Define NSS_NSCD_RETRY. Add __nscd_getai prototype. * nss/getXXbyYY_r.c: Remode definition of NSS_NSCD_RETRY. * nscd/nscd-client.h: Remove __nscd_getai prototype. * nscd/nscd_getai.c: Include nscd_proto.h. * elf/ldd.bash.in: Add support for SELinux environments. Patch by Stephen Smalley <sds@epoch.ncsc.mil>.
Diffstat (limited to 'nscd/connections.c')
| -rw-r--r-- | nscd/connections.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/nscd/connections.c b/nscd/connections.c index fe33c76bcf..164fdfbc84 100644 --- a/nscd/connections.c +++ b/nscd/connections.c @@ -41,6 +41,7 @@ #include "nscd.h" #include "dbg_log.h" +#include "selinux.h" /* Number of bytes of data we initially reserve for each hash table bucket. */ @@ -592,6 +593,15 @@ cannot handle old request version %d; current version is %d"), return; } + /* Make the SELinux check before we go on to the standard checks. We + need to verify that the request type is valid, since it has not + yet been checked at this point. */ + if (selinux_enabled + && __builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME + && __builtin_expect (req->type, LASTREQ) < LASTREQ + && nscd_request_avc_has_perm (fd, req->type) != 0) + return; + struct database_dyn *db = serv2db[req->type]; if ((__builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME |