SELINUX_CHILD: fail immediately if set-id fails

SSSD · Dec 12, 2024 · 8858fcd · 8858fcd
1 parent 132d208
commit 8858fcd
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
@@ -377,8 +377,8 @@ int main(int argc, const char *argv[])
         ret = setresuid(0, 0, -1);
         if (ret == -1) {
             ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "setuid() failed: %d, selinux_child might not work!\n", ret);
+            DEBUG(SSSDBG_CRIT_FAILURE, "setresuid() failed: %d\n", ret);
+            goto fail;
         }
     }
     if (getgid() != 0) {
@@ -387,8 +387,8 @@ int main(int argc, const char *argv[])
         ret = setresgid(0, 0, -1);
         if (ret == -1) {
             ret = errno;
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "setgid() failed: %d, selinux_child might not work!\n", ret);
+            DEBUG(SSSDBG_CRIT_FAILURE, "setresgid() failed: %d\n", ret);
+            goto fail;
         }
     }
     sss_drop_all_caps();