mirror of
https://github.com/systemd/systemd-stable.git
synced 2024-10-27 10:25:06 +03:00
shared: create files even if the SELinux policy has no context for them
The SELinux policy defines no context for some files. E.g.:
$ matchpathcon /run/lock/subsys /dev/mqueue
/run/lock/subsys <<none>>
/dev/mqueue <<none>>
We still need to be able to create them.
In this case selabel_lookup_raw() returns ENOENT. We should then skip
setfscreatecon(), but still return success.
It was broken since c34255bdb2
("label: unify code to make directories,
symlinks").
This commit is contained in:
parent
3f85ef0f05
commit
2d58aa4692
@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) {
|
|||||||
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
|
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (r < 0 && errno != ENOENT)
|
/* No context specified by the policy? Proceed without setting it. */
|
||||||
|
if (r < 0 && errno == ENOENT)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if (r < 0)
|
||||||
r = -errno;
|
r = -errno;
|
||||||
else if (r == 0) {
|
else {
|
||||||
r = setfscreatecon(filecon);
|
r = setfscreatecon(filecon);
|
||||||
if (r < 0) {
|
if (r < 0) {
|
||||||
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);
|
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);
|
||||||
|
Loading…
Reference in New Issue
Block a user