The SELinux policy defines no context for some files. E.g.:
$ matchpathcon /run/lock/subsys /dev/mqueue
/run/lock/subsys <<none>>
/dev/mqueue <<none>>
We still need to be able to create them.
In this case selabel_lookup_raw() returns ENOENT. We should then skip
setfscreatecon(), but still return success.
It was broken since
c34255bdb2 ("label: unify code to make directories,
symlinks").
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
}
r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);
}
- if (r < 0 && errno != ENOENT)
+ /* No context specified by the policy? Proceed without setting it. */
+ if (r < 0 && errno == ENOENT)
+ return 0;
+
+ if (r < 0)
r = setfscreatecon(filecon);
if (r < 0) {
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);
r = setfscreatecon(filecon);
if (r < 0) {
log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);