Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 9 Feb 2006 18:37:38 GMT
From:      Rob Deker <deker@FreeBSD.org>
To:        Perforce Change Reviews <perforce@FreeBSD.org>
Subject:   PERFORCE change 91439 for review
Message-ID:  <200602091837.k19Ibc6V026632@repoman.freebsd.org>

next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=91439

Change 91439 by deker@deker_build1.columbia.sparta.com on 2006/02/09 18:37:17

	per millert:
	
	  "Allow the user to login even if sedarwin module is not loaded.
	   the MAC login plugin bits could be much better but this
	   probably requires changes to the generic MAC login plugin
	   code."
	
	Submitted by: millert

Affected files ...

.. //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/MAC.loginPlugin.xcode/project.pbxproj#2 edit
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/plugins/SEDarwin/SEDarwin.h#2 edit
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/plugins/SEDarwin/SEDarwin.m#2 edit
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/pam_modules/pam_sedarwin/GNUmakefile#2 edit
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/pam_modules/pam_sedarwin/pam_sedarwin.c#2 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/MAC.loginPlugin.xcode/project.pbxproj#2 (text+ko) ====

@@ -81,7 +81,7 @@
 				GCC_PRECOMPILE_PREFIX_HEADER = YES;
 				GCC_PREFIX_HEADER = "$(SYSTEM_LIBRARY_DIR)/Frameworks/AppKit.framework/Headers/AppKit.h";
 				INFOPLIST_FILE = plugins/SEDarwin/Info.plist;
-				OTHER_CFLAGS = "-I../../xnu/BUILD/obj/EXPORT_HDRS/bsd -idirafter ../../xnu/BUILD/obj/EXPORT_HDRS/osfmk -I../../../sedarwin/libselinux/include";
+				OTHER_CFLAGS = "-I../../xnu/BUILD/obj/EXPORT_HDRS/bsd -idirafter ../../xnu/BUILD/obj/EXPORT_HDRS/osfmk -I../../../sedarwin/libselinux/include  -I../../../sedarwin";
 				OTHER_LDFLAGS = "-framework Foundation -framework AppKit -L../../libmac -lmac -L../../../sedarwin/libselinux/src -lselinux";
 				OTHER_REZFLAGS = "";
 				PRODUCT_NAME = SEDarwin;

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/plugins/SEDarwin/SEDarwin.h#2 (text+ko) ====

@@ -7,6 +7,7 @@
 #include <sys/mac.h> 
 #include <pwd.h> 
 #include <selinux/get_context_list.h>
+#include <sedarwin/sebsd.h>
 
 @interface SEDarwin : NSObject <MACpolicyPlugin>
 {

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/osx_cmds/MAC.loginPlugin/plugins/SEDarwin/SEDarwin.m#2 (text+ko) ====

@@ -41,6 +41,9 @@
 		return;
 	}
 
+	if (!sebsd_enabled())
+		return;
+
 	/*
 	 * Get an ordered list of possible contexts for the user and
 	 * use them to populate the popup button (in the same order).
@@ -84,6 +87,10 @@
 		return (MAC_LOGIN_FAIL);
 	}
 
+	/* XXX - use SELINUX_DEFAULTUSER and fill in selector if not enabled? */
+	if (!sebsd_enabled())
+		return (MAC_LOGIN_OK);
+
 	/*
 	 * Get the selected context from the popup button and
 	 * convert it to a label.
@@ -119,6 +126,7 @@
 
 - (void) policyWillLogin {
 	free(username);
+	if (label != NULL)	/* XXX */
 	mac_free(label);
 }
 

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/pam_modules/pam_sedarwin/GNUmakefile#2 (text+ko) ====

@@ -7,7 +7,7 @@
 Extra_CC_Flags	=-I../../pam/pam/libpam/include/pam/ \
 		 -I../../xnu/BUILD/obj/EXPORT_HDRS/bsd/ \
 		 -idirafter ../../xnu/BUILD/obj/EXPORT_HDRS/osfmk \
-		 -I../../../sedarwin/libselinux/include/
+		 -I../../../sedarwin -I../../../sedarwin/libselinux/include
 
 Extra_LD_Flags	=-L../../../sedarwin/libselinux/src/ -lselinux \
 		 -L../../libmac/ -lmac

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/pam_modules/pam_sedarwin/pam_sedarwin.c#2 (text+ko) ====

@@ -33,6 +33,7 @@
 #include <sys/types.h>
 #include <sys/mac.h> 
 #include <selinux/get_context_list.h>
+#include <sedarwin/sebsd.h>
 
 #include <ctype.h>
 #include <stdio.h>
@@ -113,6 +114,12 @@
 	const char *user;
 	int ncontexts, retval, which;
 
+	/* XXX - use SELINUX_DEFAULTUSER if not enabled? */
+	if (!sebsd_enabled()) {
+		syslog(LOG_ERR, "%s(): SEDarwin not enabled", __func__);
+		return (PAM_SUCCESS);
+	}
+
 	if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) {
 		syslog(LOG_ERR, "%s(): unable to get user %s",
 		    __func__, user);
@@ -164,6 +171,11 @@
 	mac_t label;
 	int retval;
 
+	if (!sebsd_enabled()) {
+		syslog(LOG_ERR, "%s(): SEDarwin not enabled", __func__);
+		return (PAM_SUCCESS);
+	}
+
 	/*
 	 * If the user didn't specify a label to use in the authentication
 	 * function get the default label.
@@ -172,8 +184,11 @@
 		security_context_t con;
 		const char *user;
 
-		if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS)
+		if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) {
+			syslog(LOG_ERR, "%s(): unable to get user %s",
+			    __func__, user);
 			return (retval);
+		}
 
 		/*
 		 * Get user's default context.  If we had a way to



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200602091837.k19Ibc6V026632>