X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fselinux-setup.c;h=a7e1fa4007f055793a3b66fab966ff3d7886420e;hp=620c49e686a56646ba25cc01b0d69bee9b842908;hb=0071d9f1db6dc9a1035cf5afb81455b67ed462f6;hpb=0843f2d65ea978b09f12da9ba61ee157d39ee237

diff --git a/src/selinux-setup.c b/src/selinux-setup.c
index 620c49e68..a7e1fa400 100644
--- a/src/selinux-setup.c
+++ b/src/selinux-setup.c
@@ -30,18 +30,28 @@
 #endif
 
 #include "selinux-setup.h"
+#include "mount-setup.h"
 #include "macro.h"
 #include "util.h"
 #include "log.h"
+#include "label.h"
+
+int selinux_setup(bool *loaded_policy) {
 
-int selinux_setup(char *const argv[]) {
 #ifdef HAVE_SELINUX
        int enforce = 0;
-       usec_t n;
+       usec_t before_load, after_load;
        security_context_t con;
+       int r;
+
+       assert(loaded_policy);
+
+       /* Make sure getcon() works, which needs /proc and /sys */
+       mount_setup_early();
 
-       /* Already initialized? */
-       if (getcon_raw(&con) == 0) {
+       /* Already initialized by somebody else? */
+       r = getcon_raw(&con);
+       if (r == 0) {
                bool initialized;
 
                initialized = !streq(con, "kernel");
@@ -51,33 +61,50 @@ int selinux_setup(char *const argv[]) {
                        return 0;
        }
 
-       /* Before we load the policy we create a flag file to ensure
-        * that after the reexec we iterate through /run and /dev to
-        * relabel things. */
-       touch("/dev/.systemd-relabel-run-dev");
+       /* Make sure we have no fds open while loading the policy and
+        * transitioning */
+       log_close();
 
-       n = now(CLOCK_MONOTONIC);
-       if (selinux_init_load_policy(&enforce) == 0) {
-               char buf[FORMAT_TIMESPAN_MAX];
+       /* Now load the policy */
+       before_load = now(CLOCK_MONOTONIC);
+       r = selinux_init_load_policy(&enforce);
 
-               n = now(CLOCK_MONOTONIC) - n;
-               log_info("Successfully loaded SELinux policy in %s, reexecuting.",
-                         format_timespan(buf, sizeof(buf), n));
+       if (r == 0) {
+               char timespan[FORMAT_TIMESPAN_MAX];
+               char *label;
 
-               /* FIXME: Ideally we'd just call setcon() here instead
-                * of having to reexecute ourselves here. */
+               label_retest_selinux();
 
-               execv(SYSTEMD_BINARY_PATH, argv);
-               log_error("Failed to reexecute: %m");
-               return -errno;
+               /* Transition to the new context */
+               r = label_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
+               if (r < 0 || label == NULL) {
+                       log_open();
+                       log_error("Failed to compute init label, ignoring.");
+               } else {
+                       r = setcon(label);
 
-       } else {
-               log_full(enforce > 0 ? LOG_ERR : LOG_WARNING, "Failed to load SELinux policy.");
+                       log_open();
+                       if (r < 0)
+                               log_error("Failed to transition into init label '%s', ignoring.", label);
+
+                       label_free(label);
+               }
 
-               unlink("/dev/.systemd-relabel-run-dev");
+               after_load = now(CLOCK_MONOTONIC);
+
+               log_info("Successfully loaded SELinux policy in %s.",
+                         format_timespan(timespan, sizeof(timespan), after_load - before_load));
+
+               *loaded_policy = true;
+
+       } else {
+               log_open();
 
-               if (enforce > 0)
+               if (enforce > 0) {
+                       log_error("Failed to load SELinux policy. Freezing.");
                        return -EIO;
+               } else
+                       log_debug("Unable to load SELinux policy. Ignoring.");
        }
 #endif