machined: open up most of machined's commands to unprivileged clients via PolicyKit

[elogind.git] / src / update-done / update-done.c

diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index b199a68972f89e72f5f76834a0b8f0def52e538d..561963e5ebd9d534f8b05a952bacdd05cd1eec11 100644 (file)
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -21,6 +21,12 @@
 
 #include "util.h"
 #include "label.h"
+#include "selinux-util.h"
+
+#define MESSAGE                                                         \
+        "This file was created by systemd-update-done. Its only \n"     \
+        "purpose is to hold a timestamp of the time this directory\n"   \
+        "was updated. See systemd-update-done.service(8).\n"
 
 static int apply_timestamp(const char *path, struct timespec *ts) {
         struct timespec twice[2];
@@ -41,13 +47,10 @@ static int apply_timestamp(const char *path, struct timespec *ts) {
 
                 if (utimensat(AT_FDCWD, path, twice, AT_SYMLINK_NOFOLLOW) < 0) {
 
-                        if (errno == EROFS) {
-                                log_debug("Can't update timestamp file %s, file system is read-only.", path);
-                                return 0;
-                        }
+                        if (errno == EROFS)
+                                return log_debug("Can't update timestamp file %s, file system is read-only.", path);
 
-                        log_error("Failed to update timestamp on %s: %m", path);
-                        return -errno;
+                        return log_error_errno(errno, "Failed to update timestamp on %s: %m", path);
                 }
 
         } else if (errno == ENOENT) {
@@ -56,38 +59,29 @@ static int apply_timestamp(const char *path, struct timespec *ts) {
 
                 /* The timestamp file doesn't exist yet? Then let's create it. */
 
-                r = label_context_set(path, S_IFREG);
-                if (r < 0) {
-                        log_error("Failed to set SELinux context for %s: %s",
-                                  path, strerror(-r));
-                        return r;
-                }
+                r = mac_selinux_create_file_prepare(path, S_IFREG);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to set SELinux context for %s: %m", path);
 
                 fd = open(path, O_CREAT|O_EXCL|O_WRONLY|O_TRUNC|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0644);
-                label_context_clear();
+                mac_selinux_create_file_clear();
 
                 if (fd < 0) {
+                        if (errno == EROFS)
+                                return log_debug("Can't create timestamp file %s, file system is read-only.", path);
 
-                        if (errno == EROFS) {
-                                log_debug("Can't create timestamp file %s, file system is read-only.", path);
-                                return 0;
-                        }
-
-                        log_error("Failed to create timestamp file %s: %m", path);
-                        return -errno;
+                        return log_error_errno(errno, "Failed to create timestamp file %s: %m", path);
                 }
 
+                (void) loop_write(fd, MESSAGE, strlen(MESSAGE), false);
+
                 twice[0] = *ts;
                 twice[1] = *ts;
 
-                if (futimens(fd, twice) < 0) {
-                        log_error("Failed to update timestamp on %s: %m", path);
-                        return -errno;
-                }
-        } else {
-                log_error("Failed to stat() timestamp file %s: %m", path);
-                return -errno;
-        }
+                if (futimens(fd, twice) < 0)
+                        return log_error_errno(errno, "Failed to update timestamp on %s: %m", path);
+        } else
+                log_error_errno(errno, "Failed to stat() timestamp file %s: %m", path);
 
         return 0;
 }
@@ -101,13 +95,13 @@ int main(int argc, char *argv[]) {
         log_open();
 
         if (stat("/usr", &st) < 0) {
-                log_error("Failed to stat /usr: %m");
+                log_error_errno(errno, "Failed to stat /usr: %m");
                 return EXIT_FAILURE;
         }
 
-        r = label_init(NULL);
+        r = mac_selinux_init(NULL);
         if (r < 0) {
-                log_error("SELinux setup failed: %s", strerror(-r));
+                log_error_errno(r, "SELinux setup failed: %m");
                 goto finish;
         }