chiark / gitweb /
Run with a custom SMACK domain (label).
authorAuke Kok <auke-jan.h.kok@intel.com>
Wed, 25 Sep 2013 22:49:42 +0000 (15:49 -0700)
committerAuke Kok <auke-jan.h.kok@intel.com>
Mon, 7 Oct 2013 17:23:20 +0000 (10:23 -0700)
Allows the systemd --system process to change its current
SMACK label to a predefined custom label (usually "system")
at boot time.

This is needed to have a few system-generated folders and
sockets automatically be created with the right SMACK
label. Without that, processes either cannot communicate with
systemd or systemd fails to perform some actions.

configure.ac
src/core/smack-setup.c

index 4f26092..00ee9bb 100644 (file)
@@ -524,6 +524,12 @@ else
         fi
 fi
 
+AC_ARG_WITH(smack-run-label,
+AS_HELP_STRING([--with-smack-run-label=STRING],
+        [run systemd --system with a specific SMACK label]),
+        [AC_DEFINE_UNQUOTED(SMACK_RUN_LABEL, ["$withval"], [Run with a smack label])],
+        [])
+
 if test "x${have_smack}" = xyes ; then
         AC_DEFINE(HAVE_SMACK, 1, [Define if SMACK is available])
 fi
index 1434dea..611bfdb 100644 (file)
@@ -36,6 +36,7 @@
 #include "macro.h"
 #include "smack-setup.h"
 #include "util.h"
+#include "fileio.h"
 #include "log.h"
 #include "label.h"
 
@@ -138,6 +139,13 @@ int smack_setup(void) {
                 return 0;
         }
 
+#ifdef SMACK_RUN_LABEL
+        r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL);
+        if (r)
+                log_warning("Failed to set SMACK label \"%s\" on self: %s",
+                            SMACK_RUN_LABEL, strerror(-r));
+#endif
+
         r = write_rules("/sys/fs/smackfs/cipso2", CIPSO_CONFIG);
         switch(r) {
         case -ENOENT: