16 Commits

Author	SHA1	Message	Date
David Herrmann	15411c0cb1	tree-wide: there is no ENOTSUP on linux ... Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.	2015-03-13 14:10:39 +01:00
Lennart Poettering	fae5694e1a	smack-util: remove warning when building without SMACK support	2014-12-04 16:17:34 +01:00
Michal Schmidt	56f64d9576	treewide: use log_*_errno whenever %m is in the format string ... If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.	2014-11-28 19:49:27 +01:00
WaLyong Cho	2ca620c4ed	smack: introduce new SmackProcessLabel option ... In service file, if the file has some of special SMACK label in ExecStart= and systemd has no permission for the special SMACK label then permission error will occurred. To resolve this, systemd should be able to set its SMACK label to something accessible of ExecStart=. So introduce new SmackProcessLabel. If label is specified with SmackProcessLabel= then the child systemd will set its label to that. To successfully execute the ExecStart=, accessible label should be specified with SmackProcessLabel=. Additionally, by SMACK policy, if the file in ExecStart= has no SMACK64EXEC then the executed process will have given label by SmackProcessLabel=. But if the file has SMACK64EXEC then the SMACK64EXEC label will be overridden. [zj: reword man page]	2014-11-24 10:20:53 -05:00
Lennart Poettering	376a298096	smack: we don't need the special labels exported, hence don't	2014-10-23 21:36:56 +02:00
Lennart Poettering	5dfc54615a	smack: rework SMACK label fixing code to follow more closely the semantics of the matching selinux code	2014-10-23 21:36:56 +02:00
Lennart Poettering	d1ce2089b4	smack: never follow symlinks when relabelling ... previously mac_smack_apply(path, NULL) would operate on the symlink itself while mac_smack_apply(path, "foo") would follow the symlink. Let's clean this up an always operate on the symlink, which appears to be the safer option.	2014-10-23 21:36:56 +02:00
Lennart Poettering	d53e386db6	smack: rework smack APIs a bit ... a) always return negative errno error codes b) always become a noop if smack is off c) always take a NULL label as a request to remove it	2014-10-23 21:36:56 +02:00
Lennart Poettering	c80d766c80	mac: rename all calls that apply a label mac_{selinux|smack}_apply_xyz(), and all that reset it to defaults mac_{selinux|smack}_fix() ... Let's clean up the naming schemes a bit and use the same one for SMACK and for SELINUX.	2014-10-23 21:36:56 +02:00
Lennart Poettering	6baa7db008	mac: also rename use_{smack,selinux,apparmor}() calls so that they share the new mac_{smack,selinux,apparmor}_xyz() convention	2014-10-23 17:34:30 +02:00
WaLyong Cho	cc56fafeeb	mac: rename apis with mac_{selinux/smack}_ prefix	2014-10-23 17:13:15 +02:00
WaLyong Cho	66b6d9d5b5	label: rearrange mandatory access control(MAC) apis ... move label apis to selinux-util.ch or smack-util.ch appropriately.	2014-10-23 17:10:05 +02:00
Kay Sievers	d2edfae0f9	build-sys: use glibc's xattr support instead of requiring libattr	2014-05-28 17:36:40 +08:00
Kay Sievers	9a4e038c15	smack: minimize ifdef use, and move all labeling to smack-util.c	2013-10-11 10:16:41 +02:00
Lennart Poettering	d682b3a7e7	security: rework selinux, smack, ima, apparmor detection logic ... Always cache the results, and bypass low-level security calls when the respective subsystem is not enabled.	2013-10-10 16:35:44 +02:00
Auke Kok	8552b17660	Smack: Test if smack is enabled before mounting ... Since on most systems with xattr systemd will compile with Smack support enabled, we still attempt to mount various fs's with Smack-only options. Before mounting any of these Smack-related filesystems with Smack specific mount options, check if Smack is functionally active on the running kernel. If Smack is really enabled in the kernel, all these Smack mounts are now *fatal*, as they should be. We no longer mount smackfs if systemd was compiled without Smack support. This makes it easier to make smackfs mount failures a critical error when Smack is enabled. We no longer mount these filesystems with their Smack specific options inside containers. There these filesystems will be mounted with there non-mount smack options for now.	2013-10-09 15:06:17 -07:00