picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

shared: create files even if the SELinux policy has no context for them

Browse source 
The SELinux policy defines no context for some files. E.g.:
  $ matchpathcon /run/lock/subsys /dev/mqueue
  /run/lock/subsys        <<none>>
  /dev/mqueue     <<none>>

We still need to be able to create them.
In this case selabel_lookup_raw() returns ENOENT. We should then skip
setfscreatecon(), but still return success.
It was broken since c34255bdb2 ("label: unify code to make directories,
symlinks").
This commit is contained in:
Michal Schmidt 2014-11-06 16:48:11 +01:00
parent 3f85ef0f05
commit 2d58aa4692
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/shared/selinux-util.c
View file

@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) {
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
}
if (r < 0 && errno != ENOENT)
/* No context specified by the policy? Proceed without setting it. */
if (r < 0 && errno == ENOENT)
return 0;
if (r < 0)
r = -errno;
else if (r == 0) {
else {
r = setfscreatecon(filecon);
if (r < 0) {
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);