X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fudev%2Fudev-node.c;h=c5d629d1ce1793127e845e0c96fb3202a3a4fb15;hp=6c9bef331ec6d9ccc2eb28ef82a511f1ce707374;hb=d682b3a7e7c7c2941a4d3e193f1e330dbc9fae89;hpb=c26547d612733371494330e26c7d3604a5dba3d9

diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 6c9bef331..c5d629d1c 100644
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -32,6 +32,7 @@
 #include <attr/xattr.h>
 #endif
 
+#include "smack-util.h"
 #include "udev.h"
 
 static int node_symlink(struct udev_device *dev, const char *node, const char *slink)
@@ -283,6 +284,11 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
         }
 
         if (apply) {
+                bool selinux = false;
+#ifdef HAVE_SMACK
+                bool smack = false;
+#endif
+
                 if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) {
                         log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
                         chmod(devnode, mode);
@@ -291,8 +297,6 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
                         log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
                 }
 
-                label_fix(devnode, true, false);
-
                 /* apply SECLABEL{$module}=$label */
                 udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) {
                         const char *name, *label;
@@ -301,11 +305,15 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
                         label = udev_list_entry_get_value(entry);
 
                         if (streq(name, "selinux")) {
-                                /* FIXME: hook up libselinux */
-                                log_error("SECLABEL: failed to set selinux label '%s'", label);
+                                selinux = true;
+                                if (label_apply(devnode, label) < 0)
+                                        log_error("SECLABEL: failed to set SELinux label '%s'", label);
+                                else
+                                        log_debug("SECLABEL: set SELinux label '%s'", label);
 
-                        } else if (streq(name, "smack")) {
-#ifdef HAVE_XATTR
+#ifdef HAVE_SMACK
+                        } else if (streq(name, "smack") && use_smack()) {
+                                smack = true;
                                 if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0)
                                         log_error("SECLABEL: failed to set SMACK label '%s'", label);
                                 else
@@ -315,6 +323,14 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
                         } else
                                 log_error("SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
                 }
+
+                /* set the defaults */
+                if (!selinux)
+                        label_fix(devnode, true, false);
+#ifdef HAVE_SMACK
+                if (!smack && use_smack())
+                        lremovexattr(devnode, "security.SMACK64");
+#endif
         }
 
         /* always update timestamp when we re-use the node, like on media change events */