resolved: apply label to /run/systemd/resolve/resolv.conf

Under an SELinux system, we want the file that is created to
have a proper context, different from the default for files in /run.
This is so that the policy can give access to almost everyone to
this file.

diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index ec181fad32b84c63ca4c4dccba4b0f029898e1e7..74f4ad5dba40c3494bf51675b03270724a678d6d 100644 (file)
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -34,6 +34,7 @@
 #include "socket-util.h"
 #include "af-list.h"
 #include "utf8.h"
+#include "fileio-label.h"
 
 #include "resolved-dns-domain.h"
 #include "resolved-conf.h"
@@ -821,7 +822,7 @@ int manager_write_resolv_conf(Manager *m) {
                 }
         }
 
-        r = fopen_temporary(path, &f, &temp_path);
+        r = fopen_temporary_label(path, path, &f, &temp_path);
         if (r < 0)
                 return r;
 

diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 88c3bcc5918c777cfacc35a1213a335c5b4487ac..ef416e5caeea1c9b2b60ff3c8fe8773ba88008e7 100644 (file)
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -38,14 +38,20 @@ int main(int argc, char *argv[]) {
         log_parse_environment();
         log_open();
 
-        umask(0022);
-
         if (argc != 1) {
                 log_error("This program takes no arguments.");
                 r = -EINVAL;
                 goto finish;
         }
 
+        umask(0022);
+
+        r = label_init(NULL);
+        if (r < 0) {
+                log_error("SELinux setup failed: %s", strerror(-r));
+                goto finish;
+        }
+
         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
         if (r < 0) {
                 log_error("Cannot resolve user name %s: %s", user, strerror(-r));