From: Michal Schmidt <mschmidt@redhat.com>
Date: Thu, 6 Nov 2014 15:48:11 +0000 (+0100)
Subject: shared: create files even if the SELinux policy has no context for them
X-Git-Tag: v218~519
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=2d58aa4692e9fc47911bff5d064ba3e328c35369;ds=sidebyside

shared: create files even if the SELinux policy has no context for them

The SELinux policy defines no context for some files. E.g.:
  $ matchpathcon /run/lock/subsys /dev/mqueue
  /run/lock/subsys        <<none>>
  /dev/mqueue     <<none>>

We still need to be able to create them.
In this case selabel_lookup_raw() returns ENOENT. We should then skip
setfscreatecon(), but still return success.
It was broken since c34255bdb2 ("label: unify code to make directories,
symlinks").
---

diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index 1eddd17d2..6bd3bf1c8 100644
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) {
                 r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
         }
 
-        if (r < 0 && errno != ENOENT)
+        /* No context specified by the policy? Proceed without setting it. */
+        if (r < 0 && errno == ENOENT)
+                return 0;
+
+        if (r < 0)
                 r = -errno;
-        else if (r == 0) {
+        else {
                 r = setfscreatecon(filecon);
                 if (r < 0) {
                         log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);