Re: Red Hat's passwd

[Joshua Brindle <jbrindle@tresys.com>]

Daniel J Walsh wrote:

> Joshua Brindle wrote:
>
>> Colin Walters wrote:
>>
>>> On Fri, 2005-08-05 at 12:14 -0400, Joshua Brindle wrote:
>>>  
>>>
>>>> The attached patch removes the selinux code from Red Hat's passwd.c 
>>>> and uses the libselinux function checkPasswdAccess.   
>>>
>>>
>>>
>>> This reminds me...there was some griping from people maintaining 
>>> modules
>>> which use libselinux about the name "checkPasswdAccess" in a shared
>>> library targeted for wide use; could we get some namespacing here?  
>>> This
>>> is a good thing for preventing symbol collisions and also for aesthetic
>>> and consistency reasons.  Perhaps avc_check_passwd_permission or
>>> security_check_passwd_permission or something?
>>>
>>>  
>>>
>> yea, thats a bad name, and it has caps!@
>>
>>> Renaming the function would be an API/ABI break, but it doesn't seem
>>> like a function that could be applicable for more than a few 
>>> programs at
>>> most.
>>>  
>>>
>> yea, the problem is really upstreaming the change in whatever 
>> packages use it (shadow, and hopefully RH passwd)
>> and some of Red Hats patches for things like vixie cron will also 
>> need to be fixed.
>>
>> Personally I'd rather not deal with a major version change needed for 
>> an api change. Granted it shouldn't be named that but it isn't 
>> crucial to fix it. We probably need to be more careful about what 
>> functions are exported in the future.
>>
>> Also, util-linux needs to be patched to use checkPasswdAccess (or 
>> whatever) rather than internally (which looks surprisingly similar to 
>> checkPasswdAccess) and there are probably more apps I'm missing.
>>
> Lets add Colins' name and then just leave checkPasswdAccess to call 
> it.  Then remove any reference to the function.
>
Sounds good to me, trivial patch to do this.. Also, I assume you will 
change the previous patch for passwd.c to the new function.

Index: checkAccess.c
===================================================================
--- checkAccess.c       (revision 920)
+++ checkAccess.c       (working copy)
@@ -6,7 +6,7 @@
 #include <selinux/flask.h>
 #include <selinux/av_permissions.h>

-int checkPasswdAccess(access_vector_t requested) {
+int selinux_check_passwd_access(access_vector_t requested) {
         int status=-1;
         security_context_t user_context;
         if (is_selinux_enabled() == 0)
@@ -31,3 +31,7 @@

         return status;
 }
+
+int checkPasswdAccess(access_vector_t requested) {
+       return selinux_check_passwd_access(requested);
+}


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.