picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

sd-bus: don't try to acquire connection selinux label unless selinux is actually enabled

Browse source 
Otherwise we might end up mistaking a SMACK label for an selinux label.

Also, fixes unexpect debug messages:

http://lists.freedesktop.org/archives/systemd-devel/2015-November/034913.html
This commit is contained in:
Lennart Poettering 2015-11-11 12:55:32 +01:00
parent a5642c7ee3
commit 7fc04b12e0
2 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/libsystemd/sd-bus/bus-control.c
View file

@ -981,8 +981,12 @@ static int bus_get_owner_creds_kdbus(sd_bus *bus, uint64_t mask, sd_bus_creds **
static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
pid_t pid = 0;
bool do_label;
int r;
bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
assert(bus);
do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
/* Avoid allocating anything if we have no chance of returning useful data */
if (!bus->ucred_valid && !do_label)

9
src/libsystemd/sd-bus/bus-socket.c
View file

@ -36,6 +36,7 @@
#include "hexdecoct.h"
#include "macro.h"
#include "missing.h"
#include "selinux-util.h"
#include "signal-util.h"
#include "stdio-util.h"
#include "string-util.h"
@ -608,9 +609,11 @@ static void bus_get_peercred(sd_bus *b) {
b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
/* Get the SELinux context of the peer */
r = getpeersec(b->input_fd, &b->label);
if (r < 0 && r != -EOPNOTSUPP)
log_debug_errno(r, "Failed to determine peer security context: %m");
if (mac_selinux_use()) {
r = getpeersec(b->input_fd, &b->label);
if (r < 0 && r != -EOPNOTSUPP)
log_debug_errno(r, "Failed to determine peer security context: %m");
}
}
static int bus_socket_start_auth_client(sd_bus *b) {