diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2004-09-17 00:04:18 +0000 |
|---|---|---|
| committer | Ulrich Drepper <drepper@redhat.com> | 2004-09-17 00:04:18 +0000 |
| commit | 74a30a5851087f40ff53f2716374c8870cd4a48a (patch) | |
| tree | 2ac1d833b6114746a43a48d3113ebf8d1df4b571 /nscd/connections.c | |
| parent | 2fff3d93b552dbddc406c41786ecfd0a1074b564 (diff) | |
Update.
2004-09-16 Ulrich Drepper <drepper@redhat.com>
* configure.in: Add test for required SELinux features.
* config.make.in: Add have-selinux entry.
* config.h.in: Add HAVE_SELINUX entry.
* nscd/Makefile (nscd-modules): Add selinux.
(CFLAGS-selinux.c): Add -fpie.
Define selinux-LIBS and use in link line.
* nscd/connections.c (handle_request): Check access SELinux permissions
before processing request.
* nscd/nscd.c (main): Initialize selinux_enabled and stop avc thread.
* nscd/nscd_stat.c: Transmit and print AVC statistics.
* nscd/selinux.c: New file.
* nscd/selinux.h: New file.
2004-09-16 Jakub Jelinek <jakub@redhat.com>
* nscd/nscd_helper.c (__nscd_unmap, get_mapping): Use __munmap
instead of munmap.
* nscd/Makefile (CFLAGS-aicache.c): Set to -fpie.
2004-09-16 Thorsten Kukuk <kukuk@suse.de>
* sysdeps/posix/getaddrinfo.c (gaih_inet): Check
__nss_not_use_nscd_hosts variable if nscd should be used or not.
2004-09-16 Ulrich Drepper <drepper@redhat.com>
* nscd/nscd_proto.h: Define NSS_NSCD_RETRY.
Add __nscd_getai prototype.
* nss/getXXbyYY_r.c: Remode definition of NSS_NSCD_RETRY.
* nscd/nscd-client.h: Remove __nscd_getai prototype.
* nscd/nscd_getai.c: Include nscd_proto.h.
* elf/ldd.bash.in: Add support for SELinux environments.
Patch by Stephen Smalley <sds@epoch.ncsc.mil>.
Diffstat (limited to 'nscd/connections.c')
| -rw-r--r-- | nscd/connections.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/nscd/connections.c b/nscd/connections.c index fe33c76bcf..164fdfbc84 100644 --- a/nscd/connections.c +++ b/nscd/connections.c @@ -41,6 +41,7 @@ #include "nscd.h" #include "dbg_log.h" +#include "selinux.h" /* Number of bytes of data we initially reserve for each hash table bucket. */ @@ -592,6 +593,15 @@ cannot handle old request version %d; current version is %d"), return; } + /* Make the SELinux check before we go on to the standard checks. We + need to verify that the request type is valid, since it has not + yet been checked at this point. */ + if (selinux_enabled + && __builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME + && __builtin_expect (req->type, LASTREQ) < LASTREQ + && nscd_request_avc_has_perm (fd, req->type) != 0) + return; + struct database_dyn *db = serv2db[req->type]; if ((__builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME |