glibc/nscd
Carlos O'Donell 0699f766b1 nscd: Make SELinux checks dynamic.
The SELinux team has indicated to me that glibc's SELinux checks
in nscd are not being carried out as they would expect the API
to be used today. They would like to move away from static header
defines for class and permissions and instead use dynamic checks
at runtime that provide an answer which is dependent on the runtime
status of SELinux i.e. more dynamic.

The following patch is a minimal change that moves us forward in
this direction.

It does the following:

* Stop checking for SELinux headers that define NSCD__SHMEMHOST.
  Check only for the presence or absence of the library.

* Don't encode the specific SELinux permission constants into a
  table at build time, and instead use the symbolic name for the
  permission as expected.

* Lookup the "What do we do if we don't know this permission?"
  policy and use that if we find SELinux's policy is older than
  the glibc policy e.g. we make a request for a permission that
  SELinux doesn't know about.

* Lastly, translate the class and permission and then make
  the permission check. This is done every time we lookup
  a permission, and this is the expected way to use the API.
  SELinux will optimize this for us, and we expect the network
  latencies to hide these extra library calls.

Tested on x86, x86-64, and via Fedora Rawhide since November 2013.

See:
https://sourceware.org/ml/libc-alpha/2014-04/msg00179.html
2014-04-14 04:10:39 -04:00
..
aicache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
cache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
connections.c nscd: Improved support for tracking startup failure in nscd service (BZ #16639) 2014-03-03 23:18:31 +05:30
dbg_log.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
dbg_log.h Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
Depend
gai.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getgrgid_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getgrnam_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
gethstbyad_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
gethstbynm3_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getpwnam_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getpwuid_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getsrvbynm_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
getsrvbypt_r.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
grpcache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
hstcache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
initgrcache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
Makefile Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
mem.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
netgroupcache.c Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760) 2014-03-27 19:48:15 +05:30
nscd_conf.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
nscd_getai.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd_getgr_r.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd_gethst_r.c Define _STRING_ARCH_unaligned unconditionally 2014-04-09 15:05:36 -05:00
nscd_getpw_r.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd_getserv_r.c Define _STRING_ARCH_unaligned unconditionally 2014-04-09 15:05:36 -05:00
nscd_helper.c Define _STRING_ARCH_unaligned unconditionally 2014-04-09 15:05:36 -05:00
nscd_initgroups.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd_netgroup.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd_proto.h Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
nscd_setup_thread.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
nscd_stat.c Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
nscd-client.h Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
nscd.c nscd: Improved support for tracking startup failure in nscd service (BZ #16639) 2014-03-03 23:18:31 +05:30
nscd.conf Implement caching of nscd 2011-10-07 10:06:31 -04:00
nscd.h nscd: Improved support for tracking startup failure in nscd service (BZ #16639) 2014-03-03 23:18:31 +05:30
nscd.init . 2007-07-31 13:33:18 +00:00
nscd.service nscd: also invalidate netgroup cache on reload 2014-03-19 14:45:10 +01:00
nscd.tmpfiles Add systemd unit file for nscd 2013-12-16 11:22:01 +10:00
pwdcache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00
res_hconf.c [BZ #4814] 2007-08-22 03:14:29 +00:00
selinux.c nscd: Make SELinux checks dynamic. 2014-04-14 04:10:39 -04:00
selinux.h Update copyright notices with scripts/update-copyrights 2014-01-01 22:00:23 +10:00
servicescache.c Use glibc_likely instead __builtin_expect. 2014-02-10 15:07:12 +01:00