picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

mkdir: append _label to all mkdir() calls that explicitly set the selinux context

This commit is contained in:
Kay Sievers 2012-05-31 12:40:20 +02:00
parent 051d68786b
commit d2e54fae5c
39 changed files with 74 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/core/automount.c
View File

@ -499,7 +499,7 @@ static void automount_enter_waiting(Automount *a) {
}
/* We knowingly ignore the results of this call */
mkdir_p(a->where, 0555);
mkdir_p_label(a->where, 0555);
if (pipe2(p, O_NONBLOCK|O_CLOEXEC) < 0) {
r = -errno;
@ -588,7 +588,7 @@ static void automount_enter_runnning(Automount *a) {
return;
}
mkdir_p(a->where, a->directory_mode);
mkdir_p_label(a->where, a->directory_mode);
/* Before we do anything, let's see if somebody is playing games with us? */
if (lstat(a->where, &st) < 0) {

2
src/core/dbus.c
View File

@ -1095,7 +1095,7 @@ static int bus_init_private(Manager *m) {
goto fail;
}
mkdir_parents(p+10, 0755);
mkdir_parents_label(p+10, 0755);
unlink(p+10);
m->private_bus = dbus_server_listen(p, &error);
free(p);

2
src/core/manager.c
View File

@ -2068,7 +2068,7 @@ static int create_generator_dir(Manager *m, char **generator, const char *name)
return -ENOMEM;
}
r = mkdir_p(p, 0755);
r = mkdir_p_label(p, 0755);
if (r < 0) {
log_error("Failed to create generator directory: %s", strerror(-r));
free(p);

6
src/core/mount-setup.c
View File

@ -130,7 +130,7 @@ static int mount_one(const MountPoint *p, bool relabel) {
/* The access mode here doesn't really matter too much, since
* the mounted file system will take precedence anyway. */
mkdir_p(p->where, 0755);
mkdir_p_label(p->where, 0755);
log_debug("Mounting %s to %s of type %s with options %s.",
p->what,
@ -404,8 +404,8 @@ int mount_setup(bool loaded_policy) {
dev_setup();
/* Create a few directories we always want around */
label_mkdir("/run/systemd", 0755);
label_mkdir("/run/systemd/system", 0755);
mkdir_label("/run/systemd", 0755);
mkdir_label("/run/systemd/system", 0755);
return 0;
}

4
src/core/mount.c
View File

@ -915,12 +915,12 @@ static void mount_enter_mounting(Mount *m) {
m->control_command_id = MOUNT_EXEC_MOUNT;
m->control_command = m->exec_command + MOUNT_EXEC_MOUNT;
mkdir_p(m->where, m->directory_mode);
mkdir_p_label(m->where, m->directory_mode);
/* Create the source directory for bind-mounts if needed */
p = get_mount_parameters_fragment(m);
if (p && mount_is_bind(p))
mkdir_p(p->what, m->directory_mode);
mkdir_p_label(p->what, m->directory_mode);
if (m->from_fragment)
r = exec_command_set(

2
src/core/path.c
View File

@ -215,7 +215,7 @@ static void path_spec_mkdir(PathSpec *s, mode_t mode) {
if (s->type == PATH_EXISTS || s->type == PATH_EXISTS_GLOB)
return;
if ((r = mkdir_p(s->path, mode)) < 0)
if ((r = mkdir_p_label(s->path, mode)) < 0)
log_warning("mkdir(%s) failed: %s", s->path, strerror(-r));
}

2
src/core/shutdown.c
View File

@ -238,7 +238,7 @@ static int prepare_new_root(void) {
}
NULSTR_FOREACH(dir, dirs)
if (mkdir_p(dir, 0755) < 0 && errno != EEXIST) {
if (mkdir_p_label(dir, 0755) < 0 && errno != EEXIST) {
log_error("Failed to mkdir %s: %m", dir);
return -errno;
}

2
src/core/socket.c
View File

@ -761,7 +761,7 @@ static int fifo_address_create(
assert(path);
assert(_fd);
mkdir_parents(path, directory_mode);
mkdir_parents_label(path, directory_mode);
r = label_context_set(path, S_IFIFO);
if (r < 0)

6
src/cryptsetup/cryptsetup-generator.c
View File

@ -175,7 +175,7 @@ static int create_disk(
goto fail;
}
mkdir_parents(to, 0755);
mkdir_parents_label(to, 0755);
if (symlink(from, to) < 0) {
log_error("Failed to create symlink '%s' to '%s': %m", from, to);
r = -errno;
@ -193,7 +193,7 @@ static int create_disk(
goto fail;
}
mkdir_parents(to, 0755);
mkdir_parents_label(to, 0755);
if (symlink(from, to) < 0) {
log_error("Failed to create symlink '%s' to '%s': %m", from, to);
r = -errno;
@ -211,7 +211,7 @@ static int create_disk(
goto fail;
}
mkdir_parents(to, 0755);
mkdir_parents_label(to, 0755);
if (symlink(from, to) < 0) {
log_error("Failed to create symlink '%s' to '%s': %m", from, to);
r = -errno;

10
src/fstab-generator/fstab-generator.c
View File

@ -151,7 +151,7 @@ static int add_swap(const char *what, struct mntent *me) {
goto finish;
}
mkdir_parents(lnk, 0755);
mkdir_parents_label(lnk, 0755);
if (symlink(unit, lnk) < 0) {
log_error("Failed to create symlink: %m");
r = -errno;
@ -174,7 +174,7 @@ static int add_swap(const char *what, struct mntent *me) {
goto finish;
}
mkdir_parents(lnk, 0755);
mkdir_parents_label(lnk, 0755);
if (symlink(unit, lnk) < 0) {
log_error("Failed to create symlink: %m");
r = -errno;
@ -326,7 +326,7 @@ static int add_mount(const char *what, const char *where, struct mntent *me) {
goto finish;
}
mkdir_parents(lnk, 0755);
mkdir_parents_label(lnk, 0755);
if (symlink(unit, lnk) < 0) {
log_error("Failed to create symlink: %m");
r = -errno;
@ -352,7 +352,7 @@ static int add_mount(const char *what, const char *where, struct mntent *me) {
goto finish;
}
mkdir_parents(lnk, 0755);
mkdir_parents_label(lnk, 0755);
if (symlink(unit, lnk) < 0) {
log_error("Failed to creat symlink: %m");
r = -errno;
@ -413,7 +413,7 @@ static int add_mount(const char *what, const char *where, struct mntent *me) {
goto finish;
}
mkdir_parents(lnk, 0755);
mkdir_parents_label(lnk, 0755);
if (symlink(automount_unit, lnk) < 0) {
log_error("Failed to create symlink: %m");
r = -errno;

2
src/getty-generator/getty-generator.c
View File

@ -47,7 +47,7 @@ static int add_symlink(const char *fservice, const char *tservice) {
goto finish;
}
mkdir_parents(to, 0755);
mkdir_parents_label(to, 0755);
r = symlink(from, to);
if (r < 0) {

2
src/journal/coredump.c
View File

@ -54,7 +54,7 @@ static int divert_coredump(void) {
log_info("Detected coredump of the journal daemon itself, diverting coredump to /var/lib/systemd/coredump/.");
mkdir_p("/var/lib/systemd/coredump", 0755);
mkdir_p_label("/var/lib/systemd/coredump", 0755);
f = fopen("/var/lib/systemd/coredump/core.systemd-journald", "we");
if (!f) {

2
src/journal/journald.c
View File

@ -1973,7 +1973,7 @@ static int system_journal_open(Server *s) {
/* OK, we really need the runtime journal, so create
* it if necessary. */
(void) mkdir_parents(fn, 0755);
(void) mkdir_parents_label(fn, 0755);
r = journal_file_open_reliably(fn, O_RDWR|O_CREAT, 0640, NULL, &s->runtime_journal);
free(fn);

4
src/libudev/libudev-device-private.c
View File

@ -35,7 +35,7 @@ static void udev_device_tag(struct udev_device *dev, const char *tag, bool add)
if (add) {
int fd;
mkdir_parents(filename, 0755);
mkdir_parents_label(filename, 0755);
fd = open(filename, O_WRONLY|O_CREAT|O_CLOEXEC|O_TRUNC|O_NOFOLLOW, 0444);
if (fd >= 0)
close(fd);
@ -119,7 +119,7 @@ int udev_device_update_db(struct udev_device *udev_device)
/* write a database file */
util_strscpyl(filename_tmp, sizeof(filename_tmp), filename, ".tmp", NULL);
mkdir_parents(filename_tmp, 0755);
mkdir_parents_label(filename_tmp, 0755);
f = fopen(filename_tmp, "we");
if (f == NULL) {
udev_err(udev, "unable to create temporary db file '%s': %m\n", filename_tmp);

2
src/locale/localed.c
View File

@ -591,7 +591,7 @@ static int write_data_x11(void) {
return 0;
}
mkdir_parents("/etc/X11/xorg.conf.d", 0755);
mkdir_parents_label("/etc/X11/xorg.conf.d", 0755);
r = fopen_temporary("/etc/X11/xorg.conf.d/00-keyboard.conf", &f, &temp_path);
if (r < 0)

6
src/login/logind-dbus.c
View File

@ -874,7 +874,7 @@ static int attach_device(Manager *m, const char *seat, const char *sysfs) {
goto finish;
}
mkdir_p("/etc/udev/rules.d", 0755);
mkdir_p_label("/etc/udev/rules.d", 0755);
r = write_one_line_file_atomic(file, rule);
if (r < 0)
goto finish;
@ -1890,9 +1890,9 @@ static DBusHandlerResult manager_message_handler(
if (r < 0)
return bus_send_error_reply(connection, message, &error, r);
mkdir_p("/var/lib/systemd", 0755);
mkdir_p_label("/var/lib/systemd", 0755);
r = safe_mkdir("/var/lib/systemd/linger", 0755, 0, 0);
r = mkdir_safe_label("/var/lib/systemd/linger", 0755, 0, 0);
if (r < 0)
return bus_send_error_reply(connection, message, &error, r);

4
src/login/logind-inhibit.c
View File

@ -84,7 +84,7 @@ int inhibitor_save(Inhibitor *i) {
assert(i);
r = safe_mkdir("/run/systemd/inhibit", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0);
if (r < 0)
goto finish;
@ -272,7 +272,7 @@ int inhibitor_create_fifo(Inhibitor *i) {
/* Create FIFO */
if (!i->fifo_path) {
r = safe_mkdir("/run/systemd/inhibit", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0);
if (r < 0)
return r;

2
src/login/logind-seat.c
View File

@ -91,7 +91,7 @@ int seat_save(Seat *s) {
if (!s->started)
return 0;
r = safe_mkdir("/run/systemd/seats", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/seats", 0755, 0, 0);
if (r < 0)
goto finish;

4
src/login/logind-session.c
View File

@ -116,7 +116,7 @@ int session_save(Session *s) {
if (!s->started)
return 0;
r = safe_mkdir("/run/systemd/sessions", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0);
if (r < 0)
goto finish;
@ -816,7 +816,7 @@ int session_create_fifo(Session *s) {
/* Create FIFO */
if (!s->fifo_path) {
r = safe_mkdir("/run/systemd/sessions", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0);
if (r < 0)
return r;

6
src/login/logind-user.c
View File

@ -98,7 +98,7 @@ int user_save(User *u) {
if (!u->started)
return 0;
r = safe_mkdir("/run/systemd/users", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/users", 0755, 0, 0);
if (r < 0)
goto finish;
@ -250,7 +250,7 @@ static int user_mkdir_runtime_path(User *u) {
assert(u);
r = safe_mkdir("/run/user", 0755, 0, 0);
r = mkdir_safe_label("/run/user", 0755, 0, 0);
if (r < 0) {
log_error("Failed to create /run/user: %s", strerror(-r));
return r;
@ -266,7 +266,7 @@ static int user_mkdir_runtime_path(User *u) {
} else
p = u->runtime_path;
r = safe_mkdir(p, 0700, u->uid, u->gid);
r = mkdir_safe_label(p, 0700, u->uid, u->gid);
if (r < 0) {
log_error("Failed to create runtime directory %s: %s", p, strerror(-r));
free(p);

2
src/login/multi-seat-x.c
View File

@ -113,7 +113,7 @@ int main(int argc, char *argv[]) {
goto fail;
}
r = safe_mkdir("/run/systemd/multi-session-x", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/multi-session-x", 0755, 0, 0);
if (r < 0) {
log_error("Failed to create directory: %s", strerror(-r));
goto fail;

10
src/nspawn/nspawn.c
View File

@ -222,7 +222,7 @@ static int mount_all(const char *dest) {
continue;
}
mkdir_p(where, 0755);
mkdir_p_label(where, 0755);
if (mount(mount_table[k].what,
where,
@ -1035,13 +1035,13 @@ int main(int argc, char *argv[]) {
goto child_fail;
}
if (mkdir_parents(home, 0775) < 0) {
log_error("mkdir_parents() failed: %m");
if (mkdir_parents_label(home, 0775) < 0) {
log_error("mkdir_parents_label() failed: %m");
goto child_fail;
}
if (safe_mkdir(home, 0775, uid, gid) < 0) {
log_error("safe_mkdir() failed: %m");
if (mkdir_safe_label(home, 0775, uid, gid) < 0) {
log_error("mkdir_safe_label() failed: %m");
goto child_fail;
}

2
src/random-seed/random-seed.c
View File

@ -68,7 +68,7 @@ int main(int argc, char *argv[]) {
goto finish;
}
if (mkdir_parents(RANDOM_SEED, 0755) < 0) {
if (mkdir_parents_label(RANDOM_SEED, 0755) < 0) {
log_error("Failed to create directories parents of %s: %m", RANDOM_SEED);
goto finish;
}

2
src/rc-local-generator/rc-local-generator.c
View File

@ -53,7 +53,7 @@ static int add_symlink(const char *service, const char *where) {
goto finish;
}
mkdir_parents(to, 0755);
mkdir_parents_label(to, 0755);
r = symlink(from, to);
if (r < 0) {

2
src/shared/ask-password-api.c
View File

@ -324,7 +324,7 @@ int ask_password_agent(
sigset_add_many(&mask, SIGINT, SIGTERM, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) == 0);
mkdir_p("/run/systemd/ask-password", 0755);
mkdir_p_label("/run/systemd/ask-password", 0755);
u = umask(0022);
fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY);

2
src/shared/cgroup-label.c
View File

@ -47,7 +47,7 @@ int cg_create(const char *controller, const char *path) {
if (r < 0)
return r;
r = mkdir_parents(fs, 0755);
r = mkdir_parents_label(fs, 0755);
if (r >= 0) {
if (mkdir(fs, 0755) >= 0)

2
src/shared/install.c
View File

@ -1151,7 +1151,7 @@ static int create_symlink(
assert(old_path);
assert(new_path);
mkdir_parents(new_path, 0755);
mkdir_parents_label(new_path, 0755);
if (symlink(old_path, new_path) >= 0) {
add_file_change(changes, n_changes, UNIT_FILE_SYMLINK, new_path, old_path);

12
src/shared/mkdir.c
View File

@ -31,7 +31,11 @@
#include "util.h"
#include "log.h"
int safe_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid) {
int mkdir_label(const char *path, mode_t mode) {
return label_mkdir(path, mode);
}
int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid) {
struct stat st;
if (label_mkdir(path, mode) >= 0)
@ -52,7 +56,7 @@ int safe_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid) {
return 0;
}
int mkdir_parents(const char *path, mode_t mode) {
int mkdir_parents_label(const char *path, mode_t mode) {
struct stat st;
const char *p, *e;
@ -96,12 +100,12 @@ int mkdir_parents(const char *path, mode_t mode) {
}
}
int mkdir_p(const char *path, mode_t mode) {
int mkdir_p_label(const char *path, mode_t mode) {
int r;
/* Like mkdir -p */
if ((r = mkdir_parents(path, mode)) < 0)
if ((r = mkdir_parents_label(path, mode)) < 0)
return r;
if (label_mkdir(path, mode) < 0 && errno != EEXIST)

7
src/shared/mkdir.h
View File

@ -22,7 +22,8 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
int safe_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid);
int mkdir_parents(const char *path, mode_t mode);
int mkdir_p(const char *path, mode_t mode);
int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid);
int mkdir_label(const char *path, mode_t mode);
int mkdir_parents_label(const char *path, mode_t mode);
int mkdir_p_label(const char *path, mode_t mode);
#endif

2
src/shared/path-lookup.c
View File

@ -122,7 +122,7 @@ static char** user_dirs(
* then filter out this link, if it is actually is
* one. */
mkdir_parents(data_home, 0777);
mkdir_parents_label(data_home, 0777);
(void) symlink("../../../.config/systemd/user", data_home);
}

2
src/shared/socket-label.c
View File

@ -106,7 +106,7 @@ int socket_address_listen(
mode_t old_mask;
/* Create parents */
mkdir_parents(a->sockaddr.un.sun_path, directory_mode);
mkdir_parents_label(a->sockaddr.un.sun_path, directory_mode);
/* Enforce the right access mode for the socket*/
old_mask = umask(~ socket_mode);

2
src/shutdownd/shutdownd.c
View File

@ -205,7 +205,7 @@ static int update_schedule_file(struct sd_shutdown_command *c) {
assert(c);
r = safe_mkdir("/run/systemd/shutdown", 0755, 0, 0);
r = mkdir_safe_label("/run/systemd/shutdown", 0755, 0, 0);
if (r < 0) {
log_error("Failed to create shutdown subdirectory: %s", strerror(-r));
return r;

2
src/test/test-udev.c
View File

@ -97,7 +97,7 @@ int main(int argc, char *argv[])
mode |= S_IFCHR;
if (strcmp(action, "remove") != 0) {
mkdir_parents(udev_device_get_devnode(dev), 0755);
mkdir_parents_label(udev_device_get_devnode(dev), 0755);
mknod(udev_device_get_devnode(dev), mode, udev_device_get_devnum(dev));
} else {
unlink(udev_device_get_devnode(dev));

2
src/tmpfiles/tmpfiles.c
View File

@ -652,7 +652,7 @@ static int create_item(Item *i) {
case CREATE_DIRECTORY:
u = umask(0);
mkdir_parents(i->path, 0755);
mkdir_parents_label(i->path, 0755);
r = mkdir(i->path, i->mode);
umask(u);

4
src/tty-ask-password-agent/tty-ask-password-agent.c
View File

@ -446,7 +446,7 @@ static int wall_tty_block(void) {
if (asprintf(&p, "/run/systemd/ask-password-block/%u:%u", major(devnr), minor(devnr)) < 0)
return -ENOMEM;
mkdir_parents(p, 0700);
mkdir_parents_label(p, 0700);
mkfifo(p, 0600);
fd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
@ -570,7 +570,7 @@ static int watch_passwords(void) {
tty_block_fd = wall_tty_block();
mkdir_p("/run/systemd/ask-password", 0755);
mkdir_p_label("/run/systemd/ask-password", 0755);
if ((notify = inotify_init1(IN_CLOEXEC)) < 0) {
r = -errno;

2
src/udev/udev-builtin-firmware.c
View File

@ -121,7 +121,7 @@ static int builtin_firmware(struct udev_device *dev, int argc, char *argv[], boo
/* This link indicates the missing firmware file and the associated device */
log_debug("did not find firmware file '%s'\n", firmware);
do {
err = mkdir_parents(misspath, 0755);
err = mkdir_parents_label(misspath, 0755);
if (err != 0 && err != -ENOENT)
break;
err = symlink(udev_device_get_devpath(dev), misspath);

6
src/udev/udev-node.c
View File

@ -100,7 +100,7 @@ static int node_symlink(struct udev *udev, const char *node, const char *slink)
} else {
log_debug("creating symlink '%s' to '%s'\n", slink, target);
do {
err = mkdir_parents(slink, 0755);
err = mkdir_parents_label(slink, 0755);
if (err != 0 && err != -ENOENT)
break;
label_context_set(slink, S_IFLNK);
@ -117,7 +117,7 @@ static int node_symlink(struct udev *udev, const char *node, const char *slink)
util_strscpyl(slink_tmp, sizeof(slink_tmp), slink, TMP_FILE_EXT, NULL);
unlink(slink_tmp);
do {
err = mkdir_parents(slink_tmp, 0755);
err = mkdir_parents_label(slink_tmp, 0755);
if (err != 0 && err != -ENOENT)
break;
label_context_set(slink_tmp, S_IFLNK);
@ -226,7 +226,7 @@ static void link_update(struct udev_device *dev, const char *slink, bool add)
do {
int fd;
err = mkdir_parents(filename, 0755);
err = mkdir_parents_label(filename, 0755);
if (err != 0 && err != -ENOENT)
break;
fd = open(filename, O_WRONLY|O_CREAT|O_CLOEXEC|O_TRUNC|O_NOFOLLOW, 0444);

2
src/udev/udev-watch.c
View File

@ -111,7 +111,7 @@ void udev_watch_begin(struct udev *udev, struct udev_device *dev)
}
snprintf(filename, sizeof(filename), "/run/udev/watch/%d", wd);
mkdir_parents(filename, 0755);
mkdir_parents_label(filename, 0755);
unlink(filename);
symlink(udev_device_get_id_filename(dev), filename);

4
src/udev/udevd.c
View File

@ -850,7 +850,7 @@ static void static_dev_create_from_modules(struct udev *udev)
continue;
util_strscpyl(filename, sizeof(filename), "/dev/", devname, NULL);
mkdir_parents(filename, 0755);
mkdir_parents_label(filename, 0755);
label_context_set(filename, mode);
log_debug("mknod '%s' %c%u:%u\n", filename, type, maj, min);
if (mknod(filename, mode, makedev(maj, min)) < 0 && errno == EEXIST)
@ -896,7 +896,7 @@ static int convert_db(struct udev *udev)
return 0;
/* make sure we do not get here again */
mkdir_parents("/run/udev/data", 0755);
mkdir_parents_label("/run/udev/data", 0755);
mkdir(filename, 0755);
/* old database */