udev: add SECLABEL{selinux}= support

diff --git a/src/shared/label.c b/src/shared/label.c
index fde39f22594fd08ac1613818a25a29ecd4a65cef..5c7cc1c906e1082e06d7ac58a170ec685d82dc92 100644 (file)
--- a/src/shared/label.c
+++ b/src/shared/label.c
@@ -384,3 +384,15 @@ skipped:
 #endif
         return bind(fd, addr, addrlen) < 0 ? -errno : 0;
 }
 #endif
         return bind(fd, addr, addrlen) < 0 ? -errno : 0;
 }

+
+int label_apply(const char *path, const char *label) {
+        int r = 0;
+
+#ifdef HAVE_SELINUX
+        if (!use_selinux())
+                return 0;
+
+        r = setfilecon(path, (char *)label);
+#endif
+        return r;
+}

diff --git a/src/shared/label.h b/src/shared/label.h
index 09e15e3c084ef88cc76ba778eea54c2dbd828ece..b190e69a61a920252afffa37eb111096c40f0b0a 100644 (file)
--- a/src/shared/label.h
+++ b/src/shared/label.h
@@ -46,6 +46,8 @@ void label_retest_selinux(void);
 
 int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen);
 
 
 int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen);
 

+int label_apply(const char *path, const char *label);
+

 int label_write_one_line_file_atomic(const char *fn, const char *line);
 int label_write_env_file(const char *fname, char **l);
 int label_fopen_temporary(const char *path, FILE **_f, char **_temp_path);
 int label_write_one_line_file_atomic(const char *fn, const char *line);
 int label_write_env_file(const char *fname, char **l);
 int label_fopen_temporary(const char *path, FILE **_f, char **_temp_path);

diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 74c19539ab7e1da4dfc8d45b9d4c73be92b4c5c0..187e24e5b6f988ab66aa6258a4c9d73559367c72 100644 (file)
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -305,8 +305,10 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
 
                         if (streq(name, "selinux")) {
                                 selinux = true;
 
                         if (streq(name, "selinux")) {
                                 selinux = true;

-                                /* FIXME: hook up libselinux */
-                                log_error("SECLABEL: failed to set selinux label '%s'", label);
+                                if (label_apply(devnode, label) < 0)
+                                        log_error("SECLABEL: failed to set SELinux label '%s'", label);
+                                else
+                                        log_debug("SECLABEL: set SELinux label '%s'", label);

 
 #ifdef HAVE_SMACK
                         } else if (streq(name, "smack")) {
 
 #ifdef HAVE_SMACK
                         } else if (streq(name, "smack")) {