selinux: figure out selinux context applied on exec() before closing all fds

[elogind.git] / src / core / execute.c

diff --git a/src/core/execute.c b/src/core/execute.c
index f9011cfef5affccac89f6362269e426adfcca946..b7ac4c7b2bae3fb20412bf789d51b06c6588aac0 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -885,7 +885,7 @@ fail:
                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
                 err = -EPERM;  /* PAM errors do not map to errno */
         } else {
-                log_error("PAM failed: %m");
+                log_error_errno(errno, "PAM failed: %m");
                 err = -errno;
         }
 
@@ -1238,11 +1238,12 @@ static int exec_child(ExecCommand *command,
                       int *error) {
 
         _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+        _cleanup_free_ char *mac_selinux_context_net = NULL;
         const char *username = NULL, *home = NULL, *shell = NULL;
         unsigned n_dont_close = 0;
         int dont_close[n_fds + 4];
-        uid_t uid = (uid_t) -1;
-        gid_t gid = (gid_t) -1;
+        uid_t uid = UID_INVALID;
+        gid_t gid = GID_INVALID;
         int i, err;
 
         assert(command);
@@ -1436,7 +1437,7 @@ static int exec_child(ExecCommand *command,
 
 #ifdef ENABLE_KDBUS
         if (params->bus_endpoint_fd >= 0 && context->bus_endpoint) {
-                uid_t ep_uid = (uid == (uid_t) -1) ? 0 : uid;
+                uid_t ep_uid = (uid == UID_INVALID) ? 0 : uid;
 
                 err = bus_kernel_set_endpoint_policy(params->bus_endpoint_fd, ep_uid, context->bus_endpoint);
                 if (err < 0) {
@@ -1584,6 +1585,16 @@ static int exec_child(ExecCommand *command,
                 }
         }
 
+#ifdef HAVE_SELINUX
+        if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
+                err = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
+                if (err < 0) {
+                        *error = EXIT_SELINUX_CONTEXT;
+                        return err;
+                }
+        }
+#endif
+
         /* We repeat the fd closing here, to make sure that
          * nothing is leaked from the PAM modules. Note that
          * we are more aggressive this time since socket_fd
@@ -1683,24 +1694,10 @@ static int exec_child(ExecCommand *command,
 
 #ifdef HAVE_SELINUX
                 if (mac_selinux_use()) {
-                        if (context->selinux_context) {
-                                err = setexeccon(context->selinux_context);
-                                if (err < 0 && !context->selinux_context_ignore) {
-                                        *error = EXIT_SELINUX_CONTEXT;
-                                        return err;
-                                }
-                        }
-
-                        if (params->selinux_context_net && socket_fd >= 0) {
-                                _cleanup_free_ char *label = NULL;
-
-                                err = mac_selinux_get_child_mls_label(socket_fd, command->path, &label);
-                                if (err < 0) {
-                                        *error = EXIT_SELINUX_CONTEXT;
-                                        return err;
-                                }
+                        char *exec_context = mac_selinux_context_net ?: context->selinux_context;
 
-                                err = setexeccon(label);
+                        if (exec_context) {
+                                err = setexeccon(exec_context);
                                 if (err < 0) {
                                         *error = EXIT_SELINUX_CONTEXT;
                                         return err;