socket: introduce SELinuxLabelViaNet option

[elogind.git] / src / shared / label.c

diff --git a/src/shared/label.c b/src/shared/label.c
index 70e5c85a11273833837b30fc7faea6fffa752d73..dd89bec6e89a5aa7738d9f7cc76550df35030e5c 100644 (file)
--- a/src/shared/label.c
+++ b/src/shared/label.c
@@ -27,12 +27,11 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
-#ifdef HAVE_XATTR
 #include <sys/xattr.h>
-#endif
 #ifdef HAVE_SELINUX
 #include <selinux/selinux.h>
 #include <selinux/label.h>
+#include <selinux/context.h>
 #endif
 
 #include "label.h"
@@ -79,7 +78,7 @@ static int smack_relabel_in_dev(const char *path) {
 
         r = setxattr(path, "security.SMACK64", label, strlen(label), 0);
         if (r < 0) {
-                log_error("Smack relabeling \"%s\" %s", path, strerror(errno));
+                log_error("Smack relabeling \"%s\" %m", path);
                 return -errno;
         }
 #endif
@@ -245,6 +244,74 @@ fail:
         return r;
 }
 
+int label_get_child_label(int socket_fd, const char *exe, char **label) {
+        int r = 0;
+
+#ifdef HAVE_SELINUX
+
+        security_context_t mycon = NULL, peercon = NULL, fcon = NULL, ret = NULL;
+        security_class_t sclass;
+        context_t pcon = NULL, bcon = NULL;
+        const char *range = NULL;
+
+        assert(socket_fd >= 0);
+        assert(exe);
+        assert(label);
+
+        r = getcon(&mycon);
+        if (r < 0)
+                goto out;
+
+        r = getpeercon(socket_fd, &peercon);
+        if (r < 0)
+                goto out;
+
+        r = getfilecon(exe, &fcon);
+        if (r < 0)
+                goto out;
+
+        bcon = context_new(mycon);
+        if (!bcon)
+                goto out;
+
+        pcon = context_new(peercon);
+        if (!pcon)
+                goto out;
+
+        range = context_range_get(pcon);
+        if (!range)
+                goto out;
+
+        r = context_range_set(bcon, range);
+        if (r)
+                goto out;
+
+        freecon(mycon);
+        mycon = context_str(bcon);
+        if (!mycon)
+                goto out;
+
+        sclass = string_to_security_class("process");
+        r = security_compute_create(mycon, fcon, sclass, &ret);
+        if (r < 0)
+                goto out;
+
+        *label = ret;
+
+out:
+        if (r && security_getenforce() == 1)
+                r = -errno;
+
+        freecon(mycon);
+        freecon(peercon);
+        freecon(fcon);
+        context_free(pcon);
+        context_free(bcon);
+
+#endif
+        return r;
+}
+
 int label_context_set(const char *path, mode_t mode) {
         int r = 0;
 
@@ -295,6 +362,8 @@ int label_socket_set(const char *label) {
 void label_context_clear(void) {
 
 #ifdef HAVE_SELINUX
+        PROTECT_ERRNO;
+
         if (!use_selinux())
                 return;
 
@@ -305,6 +374,8 @@ void label_context_clear(void) {
 void label_socket_clear(void) {
 
 #ifdef HAVE_SELINUX
+        PROTECT_ERRNO;
+
         if (!use_selinux())
                 return;