chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
selinux: use setcon() instead of reexec to apply selinux policy
[elogind.git]
/
src
/
selinux-setup.c
diff --git
a/src/selinux-setup.c
b/src/selinux-setup.c
index 793cb03459216f23e62b90fa9554e9b671d44bf7..fdc316048add74cf1844f6d570219576286e0611 100644
(file)
--- a/
src/selinux-setup.c
+++ b/
src/selinux-setup.c
@@
-33,15
+33,21
@@
#include "macro.h"
#include "util.h"
#include "log.h"
#include "macro.h"
#include "util.h"
#include "log.h"
+#include "label.h"
+
+int selinux_setup(bool *loaded_policy) {
-int selinux_setup(char *const argv[]) {
#ifdef HAVE_SELINUX
int enforce = 0;
#ifdef HAVE_SELINUX
int enforce = 0;
- usec_t
n
;
+ usec_t
before_load, after_load
;
security_context_t con;
security_context_t con;
+ int r;
+
+ assert(loaded_policy);
- /* Already initialized? */
- if (getcon_raw(&con) == 0) {
+ /* Already initialized by somebody else? */
+ r = getcon_raw(&con);
+ if (r == 0) {
bool initialized;
initialized = !streq(con, "kernel");
bool initialized;
initialized = !streq(con, "kernel");
@@
-51,33
+57,46
@@
int selinux_setup(char *const argv[]) {
return 0;
}
return 0;
}
- /* Before we load the policy we create a flag file to ensure
- * that after the reexec we iterate through /run and /dev to
- * relabel things. */
- touch("/dev/.systemd-relabel-run-dev");
+ /* Make sure we have no fds open while loading the policy and
+ * transitioning */
+ log_close();
- n = now(CLOCK_MONOTONIC);
- if (selinux_init_load_policy(&enforce) == 0) {
-
char buf[FORMAT_TIMESPAN_MAX]
;
+ /* Now load the policy */
+ before_load = now(CLOCK_MONOTONIC);
+
r = selinux_init_load_policy(&enforce)
;
- n = now(CLOCK_MONOTONIC) - n;
- log_info("Successfully loaded SELinux policy in %s, reexecuting.",
-
format_timespan(buf, sizeof(buf), n))
;
+ if (r == 0) {
+ char timespan[FORMAT_TIMESPAN_MAX];
+
char *label
;
- /* FIXME: Ideally we'd just call setcon() here instead
- * of having to reexecute ourselves here. */
+ /* Transition to the new context */
+ r = label_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
+ if (r < 0) {
+ log_open();
+ log_error("Failed to compute init label, ignoring.");
+ } else {
+ r = setcon(label);
-
execv(SYSTEMD_BINARY_PATH, argv
);
- log_error("Failed to reexecute: %m");
-
return -errno
;
+
log_open(
);
+ if (r < 0)
+
log_error("Failed to transition into init label '%s', ignoring.", label)
;
- } else {
- unlink("/dev/.systemd-relabel-run-dev");
+ label_free(label);
+ }
+
+ after_load = now(CLOCK_MONOTONIC);
+ log_info("Successfully loaded SELinux policy in %s.",
+ format_timespan(timespan, sizeof(timespan), after_load - before_load));
+
+ *loaded_policy = true;
+
+ } else {
if (enforce > 0) {
if (enforce > 0) {
- log_
full(LOG_ERR,
"Failed to load SELinux policy.");
+ log_
error(
"Failed to load SELinux policy.");
return -EIO;
return -EIO;
- }
+ } else
+ log_debug("Unable to load SELinux policy.");
}
#endif
}
#endif