if (params->selinux_context_net && socket_fd >= 0) {
_cleanup_free_ char *label = NULL;
- err = label_get_child_mls_label(socket_fd, command->path, &label);
+ err = mac_selinux_get_child_mls_label(socket_fd, command->path, &label);
if (err < 0) {
*error = EXIT_SELINUX_CONTEXT;
return err;
dual_timestamp_get(&security_finish_timestamp);
}
- if (label_init(NULL) < 0)
+ if (mac_selinux_init(NULL) < 0)
goto finish;
if (!skip_setup) {
free(arg_start_timeout_reboot_arg);
arg_start_timeout_reboot_arg = NULL;
- label_finish();
+ mac_selinux_finish();
if (reexecute) {
const char **args;
goto fail;
}
- label_context_set(d, st.st_mode);
+ mac_selinux_context_set(d, st.st_mode);
r = mknod(dn, st.st_mode, st.st_rdev);
- label_context_clear();
+ mac_selinux_context_clear();
if (r < 0) {
r = -errno;
retest_selinux();
/* Transition to the new context */
- r = label_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
+ r = mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH, &label);
if (r < 0 || label == NULL) {
log_open();
log_error("Failed to compute init label, ignoring.");
if (r < 0)
log_error("Failed to transition into init label '%s', ignoring.", label);
- label_free(label);
+ mac_selinux_free(label);
}
after_load = now(CLOCK_MONOTONIC);
}
if (s->smack_ip_in)
- if (smack_label_ip_in_fd(fd, s->smack_ip_in) < 0)
- log_error_unit(UNIT(s)->id, "smack_label_ip_in_fd: %m");
+ if (mac_smack_set_ip_in_fd(fd, s->smack_ip_in) < 0)
+ log_error_unit(UNIT(s)->id, "mac_smack_set_ip_in_fd: %m");
if (s->smack_ip_out)
- if (smack_label_ip_out_fd(fd, s->smack_ip_out) < 0)
- log_error_unit(UNIT(s)->id, "smack_label_ip_out_fd: %m");
+ if (mac_smack_set_ip_out_fd(fd, s->smack_ip_out) < 0)
+ log_error_unit(UNIT(s)->id, "mac_smack_set_ip_out_fd: %m");
}
static void socket_apply_fifo_options(Socket *s, int fd) {
"F_SETPIPE_SZ: %m");
if (s->smack)
- if (smack_label_fd(fd, s->smack) < 0)
- log_error_unit(UNIT(s)->id, "smack_label_fd: %m");
+ if (mac_smack_set_fd(fd, s->smack) < 0)
+ log_error_unit(UNIT(s)->id, "mac_smack_set_fd: %m");
}
static int fifo_address_create(
mkdir_parents_label(path, directory_mode);
- r = label_context_set(path, S_IFIFO);
+ r = mac_selinux_context_set(path, S_IFIFO);
if (r < 0)
goto fail;
goto fail;
}
- label_context_clear();
+ mac_selinux_context_clear();
if (fstat(fd, &st) < 0) {
r = -errno;
return 0;
fail:
- label_context_clear();
+ mac_selinux_context_clear();
safe_close(fd);
return r;
if (p->type == SOCKET_SOCKET) {
if (!know_label && s->selinux_context_from_net) {
- r = label_get_our_label(&label);
+ r = mac_selinux_get_our_label(&label);
if (r < 0)
return r;
know_label = true;
if (UNIT_ISSET(s->service) &&
SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]) {
- r = label_get_create_label_from_exe(SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]->path, &label);
+ r = mac_selinux_get_create_label_from_exe(SERVICE(UNIT_DEREF(s->service))->exec_command[SERVICE_EXEC_START]->path, &label);
if (r < 0 && r != -EPERM)
return r;
}
assert_not_reached("Unknown port type");
}
- label_free(label);
+ mac_selinux_free(label);
return 0;
rollback:
socket_close_fds(s);
- label_free(label);
+ mac_selinux_free(label);
return r;
}
log_open();
umask(0022);
- label_init("/etc");
+ mac_selinux_init("/etc");
if (argc != 1) {
log_error("This program takes no arguments.");
log_open();
umask(0022);
- label_init("/etc");
+ mac_selinux_init("/etc");
if (argc != 1) {
log_error("This program takes no arguments.");
return -ENOMEM;
mkdir_p_label("/etc/udev/rules.d", 0755);
- label_init("/etc");
+ mac_selinux_init("/etc");
r = write_string_file_atomic_label(file, rule);
if (r < 0)
return r;
umask(0022);
- r = label_init(NULL);
+ r = mac_selinux_init(NULL);
if (r < 0) {
log_error("SELinux setup failed: %s", strerror(-r));
goto finish;
assert(old_path);
assert(new_path);
- r = label_context_set(new_path, S_IFLNK);
+ r = mac_selinux_context_set(new_path, S_IFLNK);
if (r < 0)
return r;
if (symlink(old_path, new_path) < 0)
r = -errno;
- label_context_clear();
+ mac_selinux_context_clear();
return r;
}
int write_string_file_atomic_label(const char *fn, const char *line) {
int r;
- r = label_context_set(fn, S_IFREG);
+ r = mac_selinux_context_set(fn, S_IFREG);
if (r < 0)
return r;
r = write_string_file_atomic(fn, line);
- label_context_clear();
+ mac_selinux_context_clear();
return r;
}
int write_env_file_label(const char *fname, char **l) {
int r;
- r = label_context_set(fname, S_IFREG);
+ r = mac_selinux_context_set(fname, S_IFREG);
if (r < 0)
return r;
r = write_env_file(fname, l);
- label_context_clear();
+ mac_selinux_context_clear();
return r;
}
const char *path, FILE **f, char **temp_path) {
int r;
- r = label_context_set(target, S_IFREG);
+ r = mac_selinux_context_set(target, S_IFREG);
if (r < 0)
return r;
r = fopen_temporary(path, f, temp_path);
- label_context_clear();
+ mac_selinux_context_clear();
return r;
}
int r = 0;
if (use_selinux()) {
- r = label_fix_selinux(path, ignore_enoent, ignore_erofs);
+ r = mac_selinux_fix(path, ignore_enoent, ignore_erofs);
if (r < 0)
return r;
}
if (use_smack()) {
- r = smack_relabel_in_dev(path);
+ r = mac_smack_relabel_in_dev(path);
if (r < 0)
return r;
}
int r;
if (use_selinux()) {
- r = label_mkdir_selinux(path, mode);
+ r = mac_selinux_mkdir(path, mode);
if (r < 0)
return r;
}
if (r < 0 && errno != EEXIST)
return -errno;
- r = smack_relabel_in_dev(path);
+ r = mac_smack_relabel_in_dev(path);
if (r < 0)
return r;
}
#endif
}
-int label_init(const char *prefix) {
+int mac_selinux_init(const char *prefix) {
int r = 0;
#ifdef HAVE_SELINUX
return r;
}
-int label_fix_selinux(const char *path, bool ignore_enoent, bool ignore_erofs) {
+int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs) {
int r = 0;
#ifdef HAVE_SELINUX
return r;
}
-void label_finish(void) {
+void mac_selinux_finish(void) {
#ifdef HAVE_SELINUX
if (!use_selinux())
#endif
}
-int label_get_create_label_from_exe(const char *exe, char **label) {
+int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
int r = 0;
return r;
}
-int label_get_our_label(char **label) {
+int mac_selinux_get_our_label(char **label) {
int r = -EOPNOTSUPP;
#ifdef HAVE_SELINUX
return r;
}
-int label_get_child_mls_label(int socket_fd, const char *exe, char **label) {
+int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, char **label) {
int r = -EOPNOTSUPP;
#ifdef HAVE_SELINUX
return r;
}
-int label_context_set(const char *path, mode_t mode) {
+int mac_selinux_context_set(const char *path, mode_t mode) {
int r = 0;
#ifdef HAVE_SELINUX
return r;
}
-int label_socket_set(const char *label) {
+int mac_selinux_socket_set(const char *label) {
#ifdef HAVE_SELINUX
if (!use_selinux())
return 0;
}
-void label_context_clear(void) {
+void mac_selinux_context_clear(void) {
#ifdef HAVE_SELINUX
PROTECT_ERRNO;
#endif
}
-void label_socket_clear(void) {
+void mac_selinux_socket_clear(void) {
#ifdef HAVE_SELINUX
PROTECT_ERRNO;
#endif
}
-void label_free(const char *label) {
+void mac_selinux_free(const char *label) {
#ifdef HAVE_SELINUX
if (!use_selinux())
#endif
}
-int label_mkdir_selinux(const char *path, mode_t mode) {
+int mac_selinux_mkdir(const char *path, mode_t mode) {
int r = 0;
#ifdef HAVE_SELINUX
return r;
}
-int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
+int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
/* Binds a socket and label its file system object according to the SELinux policy */
return bind(fd, addr, addrlen) < 0 ? -errno : 0;
}
-int label_apply(const char *path, const char *label) {
+int mac_selinux_apply(const char *path, const char *label) {
int r = 0;
#ifdef HAVE_SELINUX
bool use_selinux(void);
void retest_selinux(void);
-int label_init(const char *prefix);
-int label_fix_selinux(const char *path, bool ignore_enoent, bool ignore_erofs);
-void label_finish(void);
+int mac_selinux_init(const char *prefix);
+int mac_selinux_fix(const char *path, bool ignore_enoent, bool ignore_erofs);
+void mac_selinux_finish(void);
-int label_socket_set(const char *label);
-void label_socket_clear(void);
+int mac_selinux_socket_set(const char *label);
+void mac_selinux_socket_clear(void);
-int label_context_set(const char *path, mode_t mode);
-void label_context_clear(void);
+int mac_selinux_context_set(const char *path, mode_t mode);
+void mac_selinux_context_clear(void);
-void label_free(const char *label);
-int label_mkdir_selinux(const char *path, mode_t mode);
+void mac_selinux_free(const char *label);
+int mac_selinux_mkdir(const char *path, mode_t mode);
-int label_get_create_label_from_exe(const char *exe, char **label);
-int label_get_our_label(char **label);
-int label_get_child_mls_label(int socket_fd, const char *exec, char **label);
+int mac_selinux_get_create_label_from_exe(const char *exe, char **label);
+int mac_selinux_get_our_label(char **label);
+int mac_selinux_get_child_mls_label(int socket_fd, const char *exec, char **label);
-int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen);
+int mac_selinux_bind(int fd, const struct sockaddr *addr, socklen_t addrlen);
-int label_apply(const char *path, const char *label);
+int mac_selinux_apply(const char *path, const char *label);
-int label_write_one_line_file_atomic(const char *fn, const char *line);
-int label_write_env_file(const char *fname, char **l);
-int label_fopen_temporary(const char *path, FILE **_f, char **_temp_path);
+int mac_selinux_write_one_line_file_atomic(const char *fn, const char *line);
+int mac_selinux_write_env_file(const char *fname, char **l);
+int mac_selinux_label_fopen_temporary(const char *path, FILE **_f, char **_temp_path);
}
-int smack_label_path(const char *path, const char *label) {
+int mac_smack_set_path(const char *path, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
return 0;
#endif
}
-int smack_label_fd(int fd, const char *label) {
+int mac_smack_set_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
return 0;
#endif
}
-int smack_label_ip_out_fd(int fd, const char *label) {
+int mac_smack_set_ip_out_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
return 0;
#endif
}
-int smack_label_ip_in_fd(int fd, const char *label) {
+int mac_smack_set_ip_in_fd(int fd, const char *label) {
#ifdef HAVE_SMACK
if (!use_smack())
return 0;
#endif
}
-int smack_relabel_in_dev(const char *path) {
+int mac_smack_relabel_in_dev(const char *path) {
int r = 0;
#ifdef HAVE_SMACK
bool use_smack(void);
-int smack_label_path(const char *path, const char *label);
-int smack_label_fd(int fd, const char *label);
-int smack_label_ip_in_fd(int fd, const char *label);
-int smack_label_ip_out_fd(int fd, const char *label);
-int smack_relabel_in_dev(const char *path);
+int mac_smack_set_path(const char *path, const char *label);
+int mac_smack_set_fd(int fd, const char *label);
+int mac_smack_set_ip_in_fd(int fd, const char *label);
+int mac_smack_set_ip_out_fd(int fd, const char *label);
+int mac_smack_relabel_in_dev(const char *path);
return -EAFNOSUPPORT;
if (label) {
- r = label_socket_set(label);
+ r = mac_selinux_socket_set(label);
if (r < 0)
return r;
}
r = fd < 0 ? -errno : 0;
if (label)
- label_socket_clear();
+ mac_selinux_socket_clear();
if (r < 0)
return r;
/* Include the original umask in our mask */
umask(~socket_mode | old_mask);
- r = label_bind(fd, &a->sockaddr.sa, a->size);
+ r = mac_selinux_bind(fd, &a->sockaddr.sa, a->size);
if (r < 0 && errno == EADDRINUSE) {
/* Unlink and try again */
umask(0022);
- r = label_init(NULL);
+ r = mac_selinux_init(NULL);
if (r < 0) {
log_error("SELinux setup failed: %s", strerror(-r));
goto finish;
return EXIT_FAILURE;
log_debug("version %s", VERSION);
- label_init("/dev");
+ mac_selinux_init("/dev");
sigprocmask(SIG_SETMASK, NULL, &sigmask_orig);
out:
if (event != NULL && event->fd_signal >= 0)
close(event->fd_signal);
- label_finish();
+ mac_selinux_finish();
return err ? EXIT_FAILURE : EXIT_SUCCESS;
}
}
}
- label_init("/etc");
+ mac_selinux_init("/etc");
return write_string_file_atomic_label("/etc/adjtime", w);
}
i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0;
RUN_WITH_UMASK(0000) {
- label_context_set(path, S_IFREG);
+ mac_selinux_context_set(path, S_IFREG);
fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode);
- label_context_clear();
+ mac_selinux_context_clear();
}
if (fd < 0) {
case CREATE_FIFO:
RUN_WITH_UMASK(0000) {
- label_context_set(i->path, S_IFIFO);
+ mac_selinux_context_set(i->path, S_IFIFO);
r = mkfifo(i->path, i->mode);
- label_context_clear();
+ mac_selinux_context_clear();
}
if (r < 0) {
if (i->force) {
RUN_WITH_UMASK(0000) {
- label_context_set(i->path, S_IFIFO);
+ mac_selinux_context_set(i->path, S_IFIFO);
r = mkfifo_atomic(i->path, i->mode);
- label_context_clear();
+ mac_selinux_context_clear();
}
if (r < 0) {
case CREATE_SYMLINK:
- label_context_set(i->path, S_IFLNK);
+ mac_selinux_context_set(i->path, S_IFLNK);
r = symlink(i->argument, i->path);
- label_context_clear();
+ mac_selinux_context_clear();
if (r < 0) {
_cleanup_free_ char *x = NULL;
if (r < 0 || !streq(i->argument, x)) {
if (i->force) {
- label_context_set(i->path, S_IFLNK);
+ mac_selinux_context_set(i->path, S_IFLNK);
r = symlink_atomic(i->argument, i->path);
- label_context_clear();
+ mac_selinux_context_clear();
if (r < 0) {
log_error("symlink(%s, %s) failed: %s", i->argument, i->path, strerror(-r));
file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR;
RUN_WITH_UMASK(0000) {
- label_context_set(i->path, file_type);
+ mac_selinux_context_set(i->path, file_type);
r = mknod(i->path, i->mode | file_type, i->major_minor);
- label_context_clear();
+ mac_selinux_context_clear();
}
if (r < 0) {
if (i->force) {
RUN_WITH_UMASK(0000) {
- label_context_set(i->path, file_type);
+ mac_selinux_context_set(i->path, file_type);
r = mknod_atomic(i->path, i->mode | file_type, i->major_minor);
- label_context_clear();
+ mac_selinux_context_clear();
}
if (r < 0) {
umask(0022);
- label_init(NULL);
+ mac_selinux_init(NULL);
items = hashmap_new(&string_hash_ops);
globs = hashmap_new(&string_hash_ops);
set_free_free(unix_sockets);
- label_finish();
+ mac_selinux_finish();
return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
err = mkdir_parents_label(slink, 0755);
if (err != 0 && err != -ENOENT)
break;
- label_context_set(slink, S_IFLNK);
+ mac_selinux_context_set(slink, S_IFLNK);
err = symlink(target, slink);
if (err != 0)
err = -errno;
- label_context_clear();
+ mac_selinux_context_clear();
} while (err == -ENOENT);
if (err == 0)
goto exit;
err = mkdir_parents_label(slink_tmp, 0755);
if (err != 0 && err != -ENOENT)
break;
- label_context_set(slink_tmp, S_IFLNK);
+ mac_selinux_context_set(slink_tmp, S_IFLNK);
err = symlink(target, slink_tmp);
if (err != 0)
err = -errno;
- label_context_clear();
+ mac_selinux_context_clear();
} while (err == -ENOENT);
if (err != 0) {
log_error("symlink '%s' '%s' failed: %m", target, slink_tmp);
if (streq(name, "selinux")) {
selinux = true;
- if (label_apply(devnode, label) < 0)
+ if (mac_selinux_apply(devnode, label) < 0)
log_error("SECLABEL: failed to set SELinux label '%s'", label);
else
log_debug("SECLABEL: set SELinux label '%s'", label);
} else if (streq(name, "smack")) {
smack = true;
- if (smack_label_path(devnode, label) < 0)
+ if (mac_smack_set_path(devnode, label) < 0)
log_error("SECLABEL: failed to set SMACK label '%s'", label);
else
log_debug("SECLABEL: set SMACK label '%s'", label);
if (!selinux)
label_fix(devnode, true, false);
if (!smack)
- smack_label_path(devnode, NULL);
+ mac_smack_set_path(devnode, NULL);
}
/* always update timestamp when we re-use the node, like on media change events */
log_parse_environment();
log_open();
udev_set_log_fn(udev, udev_main_log);
- label_init("/dev");
+ mac_selinux_init("/dev");
while ((c = getopt_long(argc, argv, "+dhV", options, NULL)) >= 0)
switch (c) {
fprintf(stderr, "%s: missing or unknown command\n", program_invocation_short_name);
rc = 2;
out:
- label_finish();
+ mac_selinux_finish();
udev_unref(udev);
log_close();
return rc;
goto exit;
}
- r = label_init("/dev");
+ r = mac_selinux_init("/dev");
if (r < 0) {
log_error("could not initialize labelling: %s", strerror(-r));
goto exit;
udev_monitor_unref(monitor);
udev_ctrl_connection_unref(ctrl_conn);
udev_ctrl_unref(udev_ctrl);
- label_finish();
+ mac_selinux_finish();
udev_unref(udev);
log_close();
return rc;
/* The timestamp file doesn't exist yet? Then let's create it. */
- r = label_context_set(path, S_IFREG);
+ r = mac_selinux_context_set(path, S_IFREG);
if (r < 0) {
log_error("Failed to set SELinux context for %s: %s",
path, strerror(-r));
}
fd = open(path, O_CREAT|O_EXCL|O_WRONLY|O_TRUNC|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0644);
- label_context_clear();
+ mac_selinux_context_clear();
if (fd < 0) {
return EXIT_FAILURE;
}
- r = label_init(NULL);
+ r = mac_selinux_init(NULL);
if (r < 0) {
log_error("SELinux setup failed: %s", strerror(-r));
goto finish;