Goal: Add selinux support to cppw Fix: Status wrt upstream: cppw is not available upstream. The patch was made based on the 302_vim_selinux_support patch. It needs to be reviewed by an SE-Linux aware person. Depends on 401_cppw_src.dpatch --- a/src/cppw.c +++ b/src/cppw.c @@ -34,6 +34,9 @@ #include #include #include +#ifdef WITH_SELINUX +#include +#endif #include "prototypes.h" #include "pwio.h" #include "shadowio.h" @@ -115,6 +118,22 @@ filenewname = filenew; if (access(file, F_OK)) cppwexit(file, 1, 1); +#ifdef WITH_SELINUX + /* if SE Linux is enabled then set the context of all new files + to be the context of the file we are editing */ + if (is_selinux_enabled ()) { + security_context_t passwd_context=NULL; + int ret = 0; + if (getfilecon (file, &passwd_context) < 0) { + cppwexit (_("Couldn't get file context"), errno, 1); + } + ret = setfscreatecon (passwd_context); + freecon (passwd_context); + if (0 != ret) { + cppwexit (_("setfscreatecon () failed"), errno, 1); + } + } +#endif if (!file_lock()) cppwexit("Couldn't lock file", errno, 5); filelocked = 1; @@ -135,6 +154,15 @@ cppwexit(0,0,1); } +#ifdef WITH_SELINUX + /* unset the fscreatecon */ + if (is_selinux_enabled ()) { + if (setfscreatecon (NULL)) { + cppwexit (_("setfscreatecon() failed"), errno, 1); + } + } +#endif + (*file_unlock)(); }