picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

core/socket: support binary inside chroot when looking for SELinux label (#8405) 

Otherwise having a .socket unit start a .service running a binary under
a chroot fails as the unit is unable to determine the SELinux label of
the binary.
This commit is contained in:
Filipe Brandenburger 2018-03-09 03:20:56 -08:00 committed by Zbigniew Jędrzejewski-Szmek
parent 906bdbf5e7
commit 416be1a03b
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/socket.c
View File

@ -1439,7 +1439,9 @@ fail:
}
static int socket_determine_selinux_label(Socket *s, char **ret) {
Service *service;
ExecCommand *c;
const char *path;
int r;
assert(s);
@ -1461,11 +1463,13 @@ static int socket_determine_selinux_label(Socket *s, char **ret) {
if (!UNIT_ISSET(s->service))
goto no_label;
c = SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START];
service = SERVICE(UNIT_DEREF(s->service));
c = service->exec_command[SERVICE_EXEC_START];
if (!c)
goto no_label;
r = mac_selinux_get_create_label_from_exe(c->path, ret);
path = prefix_roota(service->exec_context.root_directory, c->path);
r = mac_selinux_get_create_label_from_exe(path, ret);
if (IN_SET(r, -EPERM, -EOPNOTSUPP))
goto no_label;
}