On Sunday, August 21, 2005 at 03:20AM, Javier Fern?ndez-Sanguino Pe?a wrote:
On Sat, Aug 20, 2005 at 07:51:17PM -0500, Mike Hokenson wrote:
I'm not sure what your patch looks like, but just testing for a NULL
u->scontext didn't work, I had to do this:
Aggg.. you are right, I don't think clearly this late, the problem is that
u->scontext is undefined, that's why free() segfaults.
How about this patch? It should also fix other segfaults which were fixed
on a Fedora patch.
Javier
diff -Nru cron-3.0pl1-88/do_command.c cron-3.0pl1-91/do_command.c
--- cron-3.0pl1-88/do_command.c 2005-08-21 03:17:04.000000000 +0200
+++ cron-3.0pl1-91/do_command.c 2005-08-21 03:13:58.000000000 +0200
@@ -331,7 +331,7 @@
fprintf(stdout,"error");
#endif
#ifdef WITH_SELINUX
- if (is_selinux_enabled() > 0) {
+ if ((is_selinux_enabled() > 0) && (u->scontext != 0L)) {
security_context_t scontext;
if (setexeccon(u->scontext) < 0) {
if (security_getenforce() > 0) {
diff -Nru cron-3.0pl1-88/user.c cron-3.0pl1-91/user.c
--- cron-3.0pl1-88/user.c 2005-08-21 03:17:04.000000000 +0200
+++ cron-3.0pl1-91/user.c 2005-08-21 03:15:37.000000000 +0200
@@ -36,7 +36,7 @@
static int get_security_context(char *name, int crontab_fd, security_context_t
*rcontext, char *tabname) {
- security_context_t scontext;
+ security_context_t scontext=NULL;
security_context_t file_context=NULL;
struct av_decision avd;
int retval=0;
@@ -50,6 +50,7 @@
log_it(name, getpid(),
"No security context but SELinux in permissive mode,"
" continuing", tabname);
+ return 0;
}
}
@@ -133,7 +134,8 @@
free_entry(e);
}
#ifdef WITH_SELINUX
- freecon(u->scontext);
+ if (u->scontext)
+ freecon(u->scontext);
#endif
free(u);
}
@@ -175,6 +177,7 @@
u->crontab = NULL;
#ifdef WITH_SELINUX
+ u->scontext = NULL;
if (is_selinux_enabled() > 0) {
char *sname=uname;
if (pw==NULL) {
Yep, works good.
(sorry, forgot to cc everyone on the reply to your other message heh).
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
