udev: set device node permissions only at "add" events

diff --git a/TODO b/TODO
index 8ebb951c21257c0dcfaf1251f3ee8b4b335f8e31..35d96ecb8e839275e4a641cbfad786cd670a9b34 100644 (file)
--- a/TODO
+++ b/TODO
@@ -29,8 +29,6 @@ Features:
 
 * exec: when deinitializating a tty device fix the perms and group, too, not only when initializing. Set access mode/gid to 0620/tty.
 
 
 * exec: when deinitializating a tty device fix the perms and group, too, not only when initializing. Set access mode/gid to 0620/tty.
 

-* udev: only reset mode/gid of /dev/tty1 and friends on ACTION=add, not ACTION=changed
-

 * DeviceAllow/DeviceDeny: disallow everything by default, but whitelist /dev/zero, /dev/null and friends
 
 * service: watchdog logic: for testing purposes allow ping, but do not require pong
 * DeviceAllow/DeviceDeny: disallow everything by default, but whitelist /dev/zero, /dev/null and friends
 
 * service: watchdog logic: for testing purposes allow ping, but do not require pong

diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 77743037041b13e18ba02b36d7d48e4712bb8f3e..1e378adf295b24fb4d62e3f5ed30c20e9ed4979d 100644 (file)
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -279,22 +279,23 @@ static int node_fixup(struct udev_device *dev, mode_t mode, uid_t uid, gid_t gid
                 goto out;
         }
 
                 goto out;
         }
 

-        if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) {
-                log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
-                chmod(devnode, mode);
-                chown(devnode, uid, gid);
-        } else {
-                log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
-        }
-

         /*
         /*

-         * Set initial selinux file context only on add events.
-         * We set the proper context on bootup (triger) or for newly
-         * added devices, but we don't change it later, in case
-         * something else has set a custom context in the meantime.
+         * Set permissions and selinux file context only on add events. We always
+         * set it on bootup (coldplug) with "trigger --action=add" for all devices
+         * and for any newly added devices (hotplug). We don't want to change it
+         * later, in case something else has applied custom settings in the meantime.

          */
          */

-        if (strcmp(udev_device_get_action(dev), "add") == 0)
-            label_fix(devnode, true, false);
+        if (strcmp(udev_device_get_action(dev), "add") == 0) {
+                if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) {
+                        log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
+                        chmod(devnode, mode);
+                        chown(devnode, uid, gid);
+                } else {
+                        log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
+                }
+
+                label_fix(devnode, true, false);
+        }

 
         /* always update timestamp when we re-use the node, like on media change events */
         utimensat(AT_FDCWD, devnode, NULL, 0);
 
         /* always update timestamp when we re-use the node, like on media change events */
         utimensat(AT_FDCWD, devnode, NULL, 0);