|
 |
f9f3018 |
From dd5e5ef3392a83525d23aa9a523e9d187fb7faaf Mon Sep 17 00:00:00 2001
|
|
|
f9f3018 |
From: Michal Schmidt <mschmidt@redhat.com>
|
|
|
f9f3018 |
Date: Thu, 6 Nov 2014 16:48:11 +0100
|
|
|
f9f3018 |
Subject: [PATCH] shared: create files even if the SELinux policy has no
|
|
|
f9f3018 |
context for them
|
|
|
f9f3018 |
|
|
|
f9f3018 |
The SELinux policy defines no context for some files. E.g.:
|
|
|
f9f3018 |
$ matchpathcon /run/lock/subsys /dev/mqueue
|
|
|
f9f3018 |
/run/lock/subsys <<none>>
|
|
|
f9f3018 |
/dev/mqueue <<none>>
|
|
|
f9f3018 |
|
|
|
f9f3018 |
We still need to be able to create them.
|
|
|
f9f3018 |
In this case selabel_lookup_raw() returns ENOENT. We should then skip
|
|
|
f9f3018 |
setfscreatecon(), but still return success.
|
|
|
f9f3018 |
It was broken since c34255bdb2 ("label: unify code to make directories,
|
|
|
f9f3018 |
symlinks").
|
|
|
f9f3018 |
|
|
|
f9f3018 |
(cherry picked from commit 2d58aa4692e9fc47911bff5d064ba3e328c35369)
|
|
|
f9f3018 |
---
|
|
|
f9f3018 |
src/shared/selinux-util.c | 8 ++++++--
|
|
|
f9f3018 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
f9f3018 |
|
|
|
f9f3018 |
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
|
|
|
f9f3018 |
index 1eddd17d27..6bd3bf1c80 100644
|
|
|
f9f3018 |
--- a/src/shared/selinux-util.c
|
|
|
f9f3018 |
+++ b/src/shared/selinux-util.c
|
|
|
f9f3018 |
@@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) {
|
|
|
f9f3018 |
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
|
|
|
f9f3018 |
}
|
|
|
f9f3018 |
|
|
|
f9f3018 |
- if (r < 0 && errno != ENOENT)
|
|
|
f9f3018 |
+ /* No context specified by the policy? Proceed without setting it. */
|
|
|
f9f3018 |
+ if (r < 0 && errno == ENOENT)
|
|
|
f9f3018 |
+ return 0;
|
|
|
f9f3018 |
+
|
|
|
f9f3018 |
+ if (r < 0)
|
|
|
f9f3018 |
r = -errno;
|
|
|
f9f3018 |
- else if (r == 0) {
|
|
|
f9f3018 |
+ else {
|
|
|
f9f3018 |
r = setfscreatecon(filecon);
|
|
|
f9f3018 |
if (r < 0) {
|
|
|
f9f3018 |
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);
|