{"action":"created","comment":{"url":"https://api.github.com/repos/systemd/systemd/pulls/comments/217297383","pull_request_review_id":154973240,"id":217297383,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIxNzI5NzM4Mw==","diff_hunk":"@@ -163,6 +164,26 @@ static int access_init(sd_bus_error *error) {\n         return 1;\n }\n \n+int mac_selinux_callback_check(\n+                void *blob,\n+                const char *name) {\n+\n+        _cleanup_free_ char *path = NULL;\n+        struct mac_selinux_callback_blob *t = blob;\n+        int exists;\n+\n+        assert(name);\n+        assert(t);\n+\n+        path = path_make_absolute(name, MAC_SELINUX_LABEL_BASE_PATH);\n+        if (!path)\n+                return -ENOMEM;\n+\n+        exists = laccess(path, F_OK) >= 0;","path":"src/core/selinux-access.c","position":30,"original_position":27,"commit_id":"cf087b2df00210de34dff8b03041f9e7e8ae16aa","original_commit_id":"1acf5f64ffda7399c213dda08019c69ff774a183","user":{"login":"cgzones","id":6131885,"node_id":"MDQ6VXNlcjYxMzE4ODU=","avatar_url":"https://avatars3.githubusercontent.com/u/6131885?v=4","gravatar_id":"","url":"https://api.github.com/users/cgzones","html_url":"https://github.com/cgzones","followers_url":"https://api.github.com/users/cgzones/followers","following_url":"https://api.github.com/users/cgzones/following{/other_user}","gists_url":"https://api.github.com/users/cgzones/gists{/gist_id}","starred_url":"https://api.github.com/users/cgzones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgzones/subscriptions","organizations_url":"https://api.github.com/users/cgzones/orgs","repos_url":"https://api.github.com/users/cgzones/repos","events_url":"https://api.github.com/users/cgzones/events{/privacy}","received_events_url":"https://api.github.com/users/cgzones/received_events","type":"User","site_admin":false},"body":"to exploit this TOCTTOU one needs write permissions to the unit file (e.g. `/lib/systemd/system/ssh.service`), which on non MAC systems root has anyway, and with enabled SELinux only very few (sysadm_t unconfied...) have and not some specialized domains like `webadm_t`.\r\n\r\n(When successfully exploiting this one could only change the to checking target context from the unit file context to the systemd process context [e.g. `sshd_unit_t` <-> `init_t`])","created_at":"2018-09-13T08:17:47Z","updated_at":"2018-09-13T08:17:47Z","html_url":"https://github.com/systemd/systemd/pull/10023#discussion_r217297383","pull_request_url":"https://api.github.com/repos/systemd/systemd/pulls/10023","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/systemd/systemd/pulls/comments/217297383"},"html":{"href":"https://github.com/systemd/systemd/pull/10023#discussion_r217297383"},"pull_request":{"href":"https://api.github.com/repos/systemd/systemd/pulls/10023"}},"in_reply_to_id":217168679},"pull_request":{"url":"https://api.github.com/repos/systemd/systemd/pulls/10023","id":213539725,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEzNTM5NzI1","html_url":"https://github.com/systemd/systemd/pull/10023","diff_url":"https://github.com/systemd/systemd/pull/10023.diff","patch_url":"https://github.com/systemd/systemd/pull/10023.patch","issue_url":"https://api.github.com/repos/systemd/systemd/issues/10023","number":10023,"state":"open","locked":false,"title":"improve SELinux support for unit handling","user":{"login":"cgzones","id":6131885,"node_id":"MDQ6VXNlcjYxMzE4ODU=","avatar_url":"https://avatars3.githubusercontent.com/u/6131885?v=4","gravatar_id":"","url":"https://api.github.com/users/cgzones","html_url":"https://github.com/cgzones","followers_url":"https://api.github.com/users/cgzones/followers","following_url":"https://api.github.com/users/cgzones/following{/other_user}","gists_url":"https://api.github.com/users/cgzones/gists{/gist_id}","starred_url":"https://api.github.com/users/cgzones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgzones/subscriptions","organizations_url":"https://api.github.com/users/cgzones/orgs","repos_url":"https://api.github.com/users/cgzones/repos","events_url":"https://api.github.com/users/cgzones/events{/privacy}","received_events_url":"https://api.github.com/users/cgzones/received_events","type":"User","site_admin":false},"body":"    - add mac_check callback to unit_file_* functions to check unit actions\r\n      Use the filecontext of /lib/systemd/system/{UNIT_NAME} as reference label for checks if available,\r\n      else the systemd runtime context\r\n      (this helps when operating on edited files in /etc/systemd/system or links to /dev/null)\r\n\r\n    - add mac checks for { bus_job_method_get_waiting_jobs / method_unref_unit /\r\n      method_list_units_by_names / method_lookup_dynamic_user_by_name /\r\n      method_lookup_dynamic_user_by_uid / method_get_dynamic_users }\r\n\r\n    - rename { kexec / switch_root / environment } checks to \"admin\"\r\n\r\nThis is a first attempt to solve #1050.\r\nThere is still some debug code present.\r\n\r\nSome questions:\r\n  - What exactly does `method_unref_unit` do? What access verb would fit?\r\n  - How are the invocations in ` src/systemctl/systemctl.c` triggered?\r\n    They are currently ignored via `mac_nocheck`.","created_at":"2018-09-06T08:46:20Z","updated_at":"2018-09-13T08:17:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8eefb31a787ae95f3fd069125020f6644a084c4c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":362042117,"node_id":"MDU6TGFiZWwzNjIwNDIxMTc=","url":"https://api.github.com/repos/systemd/systemd/labels/install","name":"install","color":"f9d0c4","default":false},{"id":222775092,"node_id":"MDU6TGFiZWwyMjI3NzUwOTI=","url":"https://api.github.com/repos/systemd/systemd/labels/reviewed/needs-rework%20%F0%9F%94%A8","name":"reviewed/needs-rework 🔨","color":"eb6420","default":false},{"id":223632189,"node_id":"MDU6TGFiZWwyMjM2MzIxODk=","url":"https://api.github.com/repos/systemd/systemd/labels/selinux","name":"selinux","color":"bfe5bf","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/systemd/systemd/pulls/10023/commits","review_comments_url":"https://api.github.com/repos/systemd/systemd/pulls/10023/comments","review_comment_url":"https://api.github.com/repos/systemd/systemd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/10023/comments","statuses_url":"https://api.github.com/repos/systemd/systemd/statuses/cf087b2df00210de34dff8b03041f9e7e8ae16aa","head":{"label":"cgzones:selinux","ref":"selinux","sha":"cf087b2df00210de34dff8b03041f9e7e8ae16aa","user":{"login":"cgzones","id":6131885,"node_id":"MDQ6VXNlcjYxMzE4ODU=","avatar_url":"https://avatars3.githubusercontent.com/u/6131885?v=4","gravatar_id":"","url":"https://api.github.com/users/cgzones","html_url":"https://github.com/cgzones","followers_url":"https://api.github.com/users/cgzones/followers","following_url":"https://api.github.com/users/cgzones/following{/other_user}","gists_url":"https://api.github.com/users/cgzones/gists{/gist_id}","starred_url":"https://api.github.com/users/cgzones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgzones/subscriptions","organizations_url":"https://api.github.com/users/cgzones/orgs","repos_url":"https://api.github.com/users/cgzones/repos","events_url":"https://api.github.com/users/cgzones/events{/privacy}","received_events_url":"https://api.github.com/users/cgzones/received_events","type":"User","site_admin":false},"repo":{"id":147543337,"node_id":"MDEwOlJlcG9zaXRvcnkxNDc1NDMzMzc=","name":"systemd","full_name":"cgzones/systemd","owner":{"login":"cgzones","id":6131885,"node_id":"MDQ6VXNlcjYxMzE4ODU=","avatar_url":"https://avatars3.githubusercontent.com/u/6131885?v=4","gravatar_id":"","url":"https://api.github.com/users/cgzones","html_url":"https://github.com/cgzones","followers_url":"https://api.github.com/users/cgzones/followers","following_url":"https://api.github.com/users/cgzones/following{/other_user}","gists_url":"https://api.github.com/users/cgzones/gists{/gist_id}","starred_url":"https://api.github.com/users/cgzones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgzones/subscriptions","organizations_url":"https://api.github.com/users/cgzones/orgs","repos_url":"https://api.github.com/users/cgzones/repos","events_url":"https://api.github.com/users/cgzones/events{/privacy}","received_events_url":"https://api.github.com/users/cgzones/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cgzones/systemd","description":"⚙️ 🐧 systemd System and Service Manager ","fork":true,"url":"https://api.github.com/repos/cgzones/systemd","forks_url":"https://api.github.com/repos/cgzones/systemd/forks","keys_url":"https://api.github.com/repos/cgzones/systemd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cgzones/systemd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cgzones/systemd/teams","hooks_url":"https://api.github.com/repos/cgzones/systemd/hooks","issue_events_url":"https://api.github.com/repos/cgzones/systemd/issues/events{/number}","events_url":"https://api.github.com/repos/cgzones/systemd/events","assignees_url":"https://api.github.com/repos/cgzones/systemd/assignees{/user}","branches_url":"https://api.github.com/repos/cgzones/systemd/branches{/branch}","tags_url":"https://api.github.com/repos/cgzones/systemd/tags","blobs_url":"https://api.github.com/repos/cgzones/systemd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cgzones/systemd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cgzones/systemd/git/refs{/sha}","trees_url":"https://api.github.com/repos/cgzones/systemd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cgzones/systemd/statuses/{sha}","languages_url":"https://api.github.com/repos/cgzones/systemd/languages","stargazers_url":"https://api.github.com/repos/cgzones/systemd/stargazers","contributors_url":"https://api.github.com/repos/cgzones/systemd/contributors","subscribers_url":"https://api.github.com/repos/cgzones/systemd/subscribers","subscription_url":"https://api.github.com/repos/cgzones/systemd/subscription","commits_url":"https://api.github.com/repos/cgzones/systemd/commits{/sha}","git_commits_url":"https://api.github.com/repos/cgzones/systemd/git/commits{/sha}","comments_url":"https://api.github.com/repos/cgzones/systemd/comments{/number}","issue_comment_url":"https://api.github.com/repos/cgzones/systemd/issues/comments{/number}","contents_url":"https://api.github.com/repos/cgzones/systemd/contents/{+path}","compare_url":"https://api.github.com/repos/cgzones/systemd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cgzones/systemd/merges","archive_url":"https://api.github.com/repos/cgzones/systemd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cgzones/systemd/downloads","issues_url":"https://api.github.com/repos/cgzones/systemd/issues{/number}","pulls_url":"https://api.github.com/repos/cgzones/systemd/pulls{/number}","milestones_url":"https://api.github.com/repos/cgzones/systemd/milestones{/number}","notifications_url":"https://api.github.com/repos/cgzones/systemd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cgzones/systemd/labels{/name}","releases_url":"https://api.github.com/repos/cgzones/systemd/releases{/id}","deployments_url":"https://api.github.com/repos/cgzones/systemd/deployments","created_at":"2018-09-05T15:52:50Z","updated_at":"2018-09-07T19:34:31Z","pushed_at":"2018-09-13T08:03:05Z","git_url":"git://github.com/cgzones/systemd.git","ssh_url":"git@github.com:cgzones/systemd.git","clone_url":"https://github.com/cgzones/systemd.git","svn_url":"https://github.com/cgzones/systemd","homepage":"https://www.freedesktop.org/wiki/Software/systemd/","size":96613,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0","node_id":"MDc6TGljZW5zZTg="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"systemd:master","ref":"master","sha":"c155a05549ea0c2d7fe5e10acecef0c5d0f998f1","user":{"login":"systemd","id":1918868,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE5MTg4Njg=","avatar_url":"https://avatars0.githubusercontent.com/u/1918868?v=4","gravatar_id":"","url":"https://api.github.com/users/systemd","html_url":"https://github.com/systemd","followers_url":"https://api.github.com/users/systemd/followers","following_url":"https://api.github.com/users/systemd/following{/other_user}","gists_url":"https://api.github.com/users/systemd/gists{/gist_id}","starred_url":"https://api.github.com/users/systemd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/systemd/subscriptions","organizations_url":"https://api.github.com/users/systemd/orgs","repos_url":"https://api.github.com/users/systemd/repos","events_url":"https://api.github.com/users/systemd/events{/privacy}","received_events_url":"https://api.github.com/users/systemd/received_events","type":"Organization","site_admin":false},"repo":{"id":32873313,"node_id":"MDEwOlJlcG9zaXRvcnkzMjg3MzMxMw==","name":"systemd","full_name":"systemd/systemd","owner":{"login":"systemd","id":1918868,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE5MTg4Njg=","avatar_url":"https://avatars0.githubusercontent.com/u/1918868?v=4","gravatar_id":"","url":"https://api.github.com/users/systemd","html_url":"https://github.com/systemd","followers_url":"https://api.github.com/users/systemd/followers","following_url":"https://api.github.com/users/systemd/following{/other_user}","gists_url":"https://api.github.com/users/systemd/gists{/gist_id}","starred_url":"https://api.github.com/users/systemd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/systemd/subscriptions","organizations_url":"https://api.github.com/users/systemd/orgs","repos_url":"https://api.github.com/users/systemd/repos","events_url":"https://api.github.com/users/systemd/events{/privacy}","received_events_url":"https://api.github.com/users/systemd/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/systemd/systemd","description":"⚙️ 🐧 systemd System and Service Manager ","fork":false,"url":"https://api.github.com/repos/systemd/systemd","forks_url":"https://api.github.com/repos/systemd/systemd/forks","keys_url":"https://api.github.com/repos/systemd/systemd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/systemd/systemd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/systemd/systemd/teams","hooks_url":"https://api.github.com/repos/systemd/systemd/hooks","issue_events_url":"https://api.github.com/repos/systemd/systemd/issues/events{/number}","events_url":"https://api.github.com/repos/systemd/systemd/events","assignees_url":"https://api.github.com/repos/systemd/systemd/assignees{/user}","branches_url":"https://api.github.com/repos/systemd/systemd/branches{/branch}","tags_url":"https://api.github.com/repos/systemd/systemd/tags","blobs_url":"https://api.github.com/repos/systemd/systemd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/systemd/systemd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/systemd/systemd/git/refs{/sha}","trees_url":"https://api.github.com/repos/systemd/systemd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/systemd/systemd/statuses/{sha}","languages_url":"https://api.github.com/repos/systemd/systemd/languages","stargazers_url":"https://api.github.com/repos/systemd/systemd/stargazers","contributors_url":"https://api.github.com/repos/systemd/systemd/contributors","subscribers_url":"https://api.github.com/repos/systemd/systemd/subscribers","subscription_url":"https://api.github.com/repos/systemd/systemd/subscription","commits_url":"https://api.github.com/repos/systemd/systemd/commits{/sha}","git_commits_url":"https://api.github.com/repos/systemd/systemd/git/commits{/sha}","comments_url":"https://api.github.com/repos/systemd/systemd/comments{/number}","issue_comment_url":"https://api.github.com/repos/systemd/systemd/issues/comments{/number}","contents_url":"https://api.github.com/repos/systemd/systemd/contents/{+path}","compare_url":"https://api.github.com/repos/systemd/systemd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/systemd/systemd/merges","archive_url":"https://api.github.com/repos/systemd/systemd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/systemd/systemd/downloads","issues_url":"https://api.github.com/repos/systemd/systemd/issues{/number}","pulls_url":"https://api.github.com/repos/systemd/systemd/pulls{/number}","milestones_url":"https://api.github.com/repos/systemd/systemd/milestones{/number}","notifications_url":"https://api.github.com/repos/systemd/systemd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/systemd/systemd/labels{/name}","releases_url":"https://api.github.com/repos/systemd/systemd/releases{/id}","deployments_url":"https://api.github.com/repos/systemd/systemd/deployments","created_at":"2015-03-25T15:27:27Z","updated_at":"2018-09-13T01:27:34Z","pushed_at":"2018-09-13T08:03:14Z","git_url":"git://github.com/systemd/systemd.git","ssh_url":"git@github.com:systemd/systemd.git","clone_url":"https://github.com/systemd/systemd.git","svn_url":"https://github.com/systemd/systemd","homepage":"https://www.freedesktop.org/wiki/Software/systemd/","size":97538,"stargazers_count":3579,"watchers_count":3579,"language":"C","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":1361,"mirror_url":null,"archived":false,"open_issues_count":1042,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0","node_id":"MDc6TGljZW5zZTg="},"forks":1361,"open_issues":1042,"watchers":3579,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/systemd/systemd/pulls/10023"},"html":{"href":"https://github.com/systemd/systemd/pull/10023"},"issue":{"href":"https://api.github.com/repos/systemd/systemd/issues/10023"},"comments":{"href":"https://api.github.com/repos/systemd/systemd/issues/10023/comments"},"review_comments":{"href":"https://api.github.com/repos/systemd/systemd/pulls/10023/comments"},"review_comment":{"href":"https://api.github.com/repos/systemd/systemd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/systemd/systemd/pulls/10023/commits"},"statuses":{"href":"https://api.github.com/repos/systemd/systemd/statuses/cf087b2df00210de34dff8b03041f9e7e8ae16aa"}},"author_association":"NONE"}}
{"actor":{"display_login":"cgzones"}}