mac: also rename use_{smack,selinux,apparmor}() calls so that they share the new...

diff --git a/src/core/condition.c b/src/core/condition.c
index 353e0c97f1d64c50bf15f24a1076af748e1ca508..ec78169fc309355b2cf5ce4677e12e733e07daf1 100644 (file)
--- a/src/core/condition.c
+++ b/src/core/condition.c
@@ -45,13 +45,13 @@ static bool condition_test_security(Condition *c) {
         assert(c->type == CONDITION_SECURITY);
 
         if (streq(c->parameter, "selinux"))
-                return use_selinux() == !c->negate;
+                return mac_selinux_use() == !c->negate;
+        if (streq(c->parameter, "smack"))
+                return mac_smack_use() == !c->negate;
         if (streq(c->parameter, "apparmor"))
-                return use_apparmor() == !c->negate;
+                return mac_apparmor_use() == !c->negate;
         if (streq(c->parameter, "ima"))
                 return use_ima() == !c->negate;
-        if (streq(c->parameter, "smack"))
-                return use_smack() == !c->negate;
 
         return c->negate;
 }

diff --git a/src/core/execute.c b/src/core/execute.c
index caff2c6b5ce9c2fcf2a72ffb03c7d11ac73dd424..c41aec222de06e3e4eacbbe6aa96aebc8616b309 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1669,7 +1669,7 @@ static int exec_child(ExecCommand *command,
 #endif
 
 #ifdef HAVE_SELINUX
-                if (use_selinux()) {
+                if (mac_selinux_use()) {
                         if (context->selinux_context) {
                                 err = setexeccon(context->selinux_context);
                                 if (err < 0 && !context->selinux_context_ignore) {
@@ -1697,7 +1697,7 @@ static int exec_child(ExecCommand *command,
 #endif
 
 #ifdef HAVE_APPARMOR
-                if (context->apparmor_profile && use_apparmor()) {
+                if (context->apparmor_profile && mac_apparmor_use()) {
                         err = aa_change_onexec(context->apparmor_profile);
                         if (err < 0 && !context->apparmor_profile_ignore) {
                                 *error = EXIT_APPARMOR_PROFILE;

diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index 8e912178283c5ddfeccdf72d7ea59c66b39fbc10..cda25ede13bcaf8775486a74f3486690979d8c3d 100644 (file)
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -82,9 +82,9 @@ static const MountPoint mount_table[] = {
           NULL,       MNT_NONE },
 #ifdef HAVE_SMACK
         { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
-          use_smack,  MNT_FATAL },
+          mac_smack_use, MNT_FATAL },
         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
-          use_smack,  MNT_FATAL },
+          mac_smack_use, MNT_FATAL },
 #endif
         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
@@ -92,7 +92,7 @@ static const MountPoint mount_table[] = {
           NULL,       MNT_IN_CONTAINER },
 #ifdef HAVE_SMACK
         { "tmpfs",      "/run",                      "tmpfs",      "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
-          use_smack,  MNT_FATAL },
+          mac_smack_use, MNT_FATAL },
 #endif
         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 184f202c1e698c43ed19bda1c5df9101fa7abe1b..08ea6efb78c48150dc9486be48fe97fccc6ba0af 100644 (file)
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -142,7 +142,7 @@ static int selinux_access_init(sd_bus_error *error) {
         if (initialized)
                 return 0;
 
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return 0;
 
         r = access_init();
@@ -186,7 +186,7 @@ int selinux_generic_access_check(
         assert(permission);
         assert(error);
 
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return 0;
 
         r = selinux_access_init(error);

diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c
index 8be97fc4173706916826ad886d953142294136f8..4e615c2b64f165a91c483d5c3b06e9540d1d2a82 100644 (file)
--- a/src/core/selinux-setup.c
+++ b/src/core/selinux-setup.c
@@ -84,7 +84,7 @@ int selinux_setup(bool *loaded_policy) {
                 char timespan[FORMAT_TIMESPAN_MAX];
                 char *label;
 
-                retest_selinux();
+                mac_selinux_retest();
 
                 /* Transition to the new context */
                 r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);

diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
index ac2d0ba148c10c8ddf3c25e1889fc028af54d62a..a6352022dd8b55422b2707fb2b618f1ab26b7cef 100644 (file)
--- a/src/journal/journald-native.c
+++ b/src/journal/journald-native.c
@@ -417,7 +417,7 @@ int server_open_native_socket(Server*s) {
         }
 
 #ifdef HAVE_SELINUX
-        if (use_selinux()) {
+        if (mac_selinux_use()) {
                 one = 1;
                 r = setsockopt(s->native_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
                 if (r < 0)

diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 991f4f2a3870c833466c05afeb4499a2f77deaa2..9709889e4acb07794dfae8adf307aa58d183798e 100644 (file)
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -680,7 +680,7 @@ static void dispatch_message_real(
                 }
 
 #ifdef HAVE_SELINUX
-                if (use_selinux()) {
+                if (mac_selinux_use()) {
                         if (label) {
                                 x = alloca(strlen("_SELINUX_CONTEXT=") + label_len + 1);
 

diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c
index 8a983d84d9f7b216f326feba865caa86aa1eb988..76580f8263a161f4c323bfc2e2b4b5d574a62cc9 100644 (file)
--- a/src/journal/journald-stream.c
+++ b/src/journal/journald-stream.c
@@ -395,7 +395,7 @@ static int stdout_stream_new(sd_event_source *es, int listen_fd, uint32_t revent
         }
 
 #ifdef HAVE_SELINUX
-        if (use_selinux()) {
+        if (mac_selinux_use()) {
                 if (getpeercon(fd, &stream->security_context) < 0 && errno != ENOPROTOOPT)
                         log_error("Failed to determine peer security context: %m");
         }

diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
index 656dc72bb9b3828fcbaed1a065bc81db354174cd..79c07fffa1d1b646e31583dec467a6310bba7fae 100644 (file)
--- a/src/journal/journald-syslog.c
+++ b/src/journal/journald-syslog.c
@@ -457,7 +457,7 @@ int server_open_syslog_socket(Server *s) {
         }
 
 #ifdef HAVE_SELINUX
-        if (use_selinux()) {
+        if (mac_selinux_use()) {
                 one = 1;
                 r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
                 if (r < 0)

diff --git a/src/login/logind-user.c b/src/login/logind-user.c
index 3847496c15cb5d574e56cb5cfe4a328ee4fed9c5..1205b48abb8f9b11b088fd40041da0e285dd122d 100644 (file)
--- a/src/login/logind-user.c
+++ b/src/login/logind-user.c
@@ -326,7 +326,7 @@ static int user_mkdir_runtime_path(User *u) {
 
                 mkdir(p, 0700);
 
-                if (use_smack())
+                if (mac_smack_use())
                         r = asprintf(&t, "mode=0700,smackfsroot=*,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size);
                 else
                         r = asprintf(&t, "mode=0700,uid=" UID_FMT ",gid=" GID_FMT ",size=%zu", u->uid, u->gid, u->manager->runtime_dir_size);

diff --git a/src/shared/apparmor-util.c b/src/shared/apparmor-util.c
index 2b85da1e4a2907557157d525bd1acc3feeef9f9b..c14843da49b74c43439f1815574493df34f0cd65 100644 (file)
--- a/src/shared/apparmor-util.c
+++ b/src/shared/apparmor-util.c
@@ -25,17 +25,16 @@
 #include "fileio.h"
 #include "apparmor-util.h"
 
-static int use_apparmor_cached = -1;
+bool mac_apparmor_use(void) {
+        static int cached_use = -1;
 
-bool use_apparmor(void) {
-
-        if (use_apparmor_cached < 0) {
+        if (cached_use < 0) {
                 _cleanup_free_ char *p = NULL;
 
-                use_apparmor_cached =
+                cached_use =
                         read_one_line_file("/sys/module/apparmor/parameters/enabled", &p) >= 0 &&
                         parse_boolean(p) > 0;
         }
 
-        return use_apparmor_cached;
+        return cached_use;
 }

diff --git a/src/shared/apparmor-util.h b/src/shared/apparmor-util.h
index 4b056a1aaed353de6b9ca92263080f96861b65ed..a3d1b3b066f1e25662d294b5e9909c2b52bd11bc 100644 (file)
--- a/src/shared/apparmor-util.h
+++ b/src/shared/apparmor-util.h
@@ -23,4 +23,4 @@
 
 #include <stdbool.h>
 
-bool use_apparmor(void);
+bool mac_apparmor_use(void);

diff --git a/src/shared/label.c b/src/shared/label.c
index bee96357315836ed2996bb520c9dc2bf83710242..fe7fd8381e5992ba8c4695811a25559020c43b98 100644 (file)
--- a/src/shared/label.c
+++ b/src/shared/label.c
@@ -25,13 +25,13 @@
 int label_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
         int r = 0;
 
-        if (use_selinux()) {
+        if (mac_selinux_use()) {
                 r = mac_selinux_fix(path, ignore_enoent, ignore_erofs);
                 if (r < 0)
                         return r;
         }
 
-        if (use_smack()) {
+        if (mac_smack_use()) {
                 r = mac_smack_relabel_in_dev(path);
                 if (r < 0)
                         return r;

diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c
index 89af39281975b7de5a162fee97df3e4ec5c4bcc4..2b9cb161cb2829cca6095290c0165aae8abd4a01 100644 (file)
--- a/src/shared/mkdir-label.c
+++ b/src/shared/mkdir-label.c
@@ -35,13 +35,13 @@
 static int label_mkdir(const char *path, mode_t mode) {
         int r;
 
-        if (use_selinux()) {
+        if (mac_selinux_use()) {
                 r = mac_selinux_mkdir(path, mode);
                 if (r < 0)
                         return r;
         }
 
-        if (use_smack()) {
+        if (mac_smack_use()) {
                 r = mkdir(path, mode);
                 if (r < 0 && errno != EEXIST)
                         return -errno;

diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index a277dad35752e5f22c1035ef5edd5307cf86ad86..5a5bfbdb0a9f020bab09530b107dc2d76fe20b2b 100644 (file)
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -40,24 +40,24 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free);
 #define _cleanup_security_context_free_ _cleanup_(freeconp)
 #define _cleanup_context_free_ _cleanup_(context_freep)
 
-static int use_selinux_cached = -1;
+static int cached_use = -1;
 static struct selabel_handle *label_hnd = NULL;
 #endif
 
-bool use_selinux(void) {
+bool mac_selinux_use(void) {
 #ifdef HAVE_SELINUX
-        if (use_selinux_cached < 0)
-                use_selinux_cached = is_selinux_enabled() > 0;
+        if (cached_use < 0)
+                cached_use = is_selinux_enabled() > 0;
 
-        return use_selinux_cached;
+        return cached_use;
 #else
         return false;
 #endif
 }
 
-void retest_selinux(void) {
+void mac_selinux_retest(void) {
 #ifdef HAVE_SELINUX
-        use_selinux_cached = -1;
+        cached_use = -1;
 #endif
 }
 
@@ -68,7 +68,7 @@ int mac_selinux_init(const char *prefix) {
         usec_t before_timestamp, after_timestamp;
         struct mallinfo before_mallinfo, after_mallinfo;
 
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return 0;
 
         if (label_hnd)
@@ -156,7 +156,7 @@ int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
 void mac_selinux_finish(void) {
 
 #ifdef HAVE_SELINUX
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return;
 
         if (label_hnd)
@@ -172,7 +172,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
         security_context_t mycon = NULL, fcon = NULL;
         security_class_t sclass;
 
-        if (!use_selinux()) {
+        if (!mac_selinux_use()) {
                 *label = NULL;
                 return 0;
         }
@@ -315,7 +315,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) {
 #ifdef HAVE_SELINUX
         security_context_t filecon = NULL;
 
-        if (!use_selinux() || !label_hnd)
+        if (!mac_selinux_use() || !label_hnd)
                 return 0;
 
         r = selabel_lookup_raw(label_hnd, &filecon, path, mode);
@@ -341,7 +341,7 @@ int mac_selinux_context_set(const char *path, mode_t mode) {
 int mac_selinux_socket_set(const char *label) {
 
 #ifdef HAVE_SELINUX
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return 0;
 
         if (setsockcreatecon((security_context_t) label) < 0) {
@@ -361,7 +361,7 @@ void mac_selinux_context_clear(void) {
 #ifdef HAVE_SELINUX
         PROTECT_ERRNO;
 
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return;
 
         setfscreatecon(NULL);
@@ -373,7 +373,7 @@ void mac_selinux_socket_clear(void) {
 #ifdef HAVE_SELINUX
         PROTECT_ERRNO;
 
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return;
 
         setsockcreatecon(NULL);
@@ -383,7 +383,7 @@ void mac_selinux_socket_clear(void) {
 void mac_selinux_free(const char *label) {
 
 #ifdef HAVE_SELINUX
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return;
 
         freecon((security_context_t) label);
@@ -450,7 +450,7 @@ int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
         assert(addr);
         assert(addrlen >= sizeof(sa_family_t));
 
-        if (!use_selinux() || !label_hnd)
+        if (!mac_selinux_use() || !label_hnd)
                 goto skipped;
 
         /* Filter out non-local sockets */
@@ -511,7 +511,7 @@ int mac_selinux_apply(const char *path, const char *label) {
         int r = 0;
 
 #ifdef HAVE_SELINUX
-        if (!use_selinux())
+        if (!mac_selinux_use())
                 return 0;
 
         r = setfilecon(path, (char *)label);

diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h
index b23a77950b89c9b866aeb7ade2bcab07d46ea17f..0ce088df7d1377016cfe8bb3a97116af061ac3df 100644 (file)
--- a/src/shared/selinux-util.h
+++ b/src/shared/selinux-util.h
@@ -25,13 +25,14 @@
 #include <stdio.h>
 #include <stdbool.h>
 
-bool use_selinux(void);
-void retest_selinux(void);
+bool mac_selinux_use(void);
+void mac_selinux_retest(void);
 
 int mac_selinux_init(const char *prefix);
-int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
 void mac_selinux_finish(void);
 
+int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
+
 int mac_selinux_socket_set(const char *label);
 void mac_selinux_socket_clear(void);
 

diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
index 33e1cd849ec38677e9a1e2e18d911fe97a8e38b7..0bedd75081f020dfa8e735075b7cb3ea4d8025cf 100644 (file)
--- a/src/shared/smack-util.c
+++ b/src/shared/smack-util.c
@@ -27,14 +27,14 @@
 #include "path-util.h"
 #include "smack-util.h"
 
-bool use_smack(void) {
+bool mac_smack_use(void) {
 #ifdef HAVE_SMACK
-        static int use_smack_cached = -1;
+        static int cached_use = -1;
 
-        if (use_smack_cached < 0)
-                use_smack_cached = access("/sys/fs/smackfs/", F_OK) >= 0;
+        if (cached_use < 0)
+                cached_use = access("/sys/fs/smackfs/", F_OK) >= 0;
 
-        return use_smack_cached;
+        return cached_use;
 #else
         return false;
 #endif
@@ -43,7 +43,7 @@ bool use_smack(void) {
 
 int mac_smack_set_path(const char *path, const char *label) {
 #ifdef HAVE_SMACK
-        if (!use_smack())
+        if (!mac_smack_use())
                 return 0;
 
         if (label)
@@ -57,7 +57,7 @@ int mac_smack_set_path(const char *path, const char *label) {
 
 int mac_smack_set_fd(int fd, const char *label) {
 #ifdef HAVE_SMACK
-        if (!use_smack())
+        if (!mac_smack_use())
                 return 0;
 
         return fsetxattr(fd, "security.SMACK64", label, strlen(label), 0);
@@ -68,7 +68,7 @@ int mac_smack_set_fd(int fd, const char *label) {
 
 int mac_smack_set_ip_out_fd(int fd, const char *label) {
 #ifdef HAVE_SMACK
-        if (!use_smack())
+        if (!mac_smack_use())
                 return 0;
 
         return fsetxattr(fd, "security.SMACK64IPOUT", label, strlen(label), 0);
@@ -79,7 +79,7 @@ int mac_smack_set_ip_out_fd(int fd, const char *label) {
 
 int mac_smack_set_ip_in_fd(int fd, const char *label) {
 #ifdef HAVE_SMACK
-        if (!use_smack())
+        if (!mac_smack_use())
                 return 0;
 
         return fsetxattr(fd, "security.SMACK64IPIN", label, strlen(label), 0);

diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h
index 91b141ad7d5632e1223577f6bb3efbfce1ad15d2..50cb79a728b6ac86265f732da8e3b63450f66583 100644 (file)
--- a/src/shared/smack-util.h
+++ b/src/shared/smack-util.h
@@ -28,7 +28,7 @@
 #define SMACK_FLOOR_LABEL "_"
 #define SMACK_STAR_LABEL  "*"
 
-bool use_smack(void);
+bool mac_smack_use(void);
 
 int mac_smack_set_path(const char *path, const char *label);
 int mac_smack_set_fd(int fd, const char *label);