picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

logind: load SELinux labelling system

Browse source 
systemd-logind uses mkdir_label and label_fix functions without calling
first mac_selinux_init.  This makes /run/user/$UID/ directories not
labelled correctly on an Arch Linux system using SELinux.

Fix this by calling mac_selinux_init("/run") early in systemd-logind.
This makes files created in /etc/udev/rules.d and /var/lib/systemd to be
labelled through transitions in the SELinux policy instead of using
setfscreatecon (with mac_selinux_create_file_prepare).
This commit is contained in:
Nicolas Iooss 2016-02-02 20:07:46 +01:00
parent b72190e90f
commit 4b51966cf6
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/login/logind-dbus.c
View file

@ -1228,7 +1228,6 @@ static int attach_device(Manager *m, const char *seat, const char *sysfs) {
return -ENOMEM;
mkdir_p_label("/etc/udev/rules.d", 0755);
mac_selinux_init("/etc");
r = write_string_file_atomic_label(file, rule);
if (r < 0)
return r;

7
src/login/logind.c
View file

@ -36,6 +36,7 @@
#include "fd-util.h"
#include "formats-util.h"
#include "logind.h"
#include "selinux-util.h"
#include "signal-util.h"
#include "strv.h"
#include "udev-util.h"
@ -1127,6 +1128,12 @@ int main(int argc, char *argv[]) {
goto finish;
}
r = mac_selinux_init("/run");
if (r < 0) {
log_error_errno(r, "Could not initialize labelling: %m");
goto finish;
}
/* Always create the directories people can create inotify
* watches in. Note that some applications might check for the
* existence of /run/systemd/seats/ to determine whether