selinux: drop mac_selinux_unit_access_check_strv()

It is not acceptable to load unit files during enable/disable operations
just to figure out the selinux labels. systemd implements lazy loading
for units, so the selinux hooks need to follow it.

This drops the mac_selinux_unit_access_check_strv() helper which
implements a non-acceptable policy check. If anyone cares for that
functionality, you really should pass a callback+userdata to the helpers
in src/shared/install.c which does policy checks on each touched file.

See #1050 on github for more.

1 files changed, 0 insertions, 27 deletions

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 2ecfa40974..f920c2e2cd 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -289,30 +289,3 @@ finish:
         return 0;
 #endif
 }
-
-int mac_selinux_unit_access_check_strv(
-                char **units,
-                sd_bus_message *message,
-                Manager *m,
-                const char *permission,
-                sd_bus_error *error) {
-
-#ifdef HAVE_SELINUX
-        char **i;
-        Unit *u;
-        int r;
-
-        STRV_FOREACH(i, units) {
-                if (is_path(*i))
-                        r = manager_load_unit(m, NULL, *i, error, &u);
-                else
-                        r = manager_load_unit(m, *i, NULL, error, &u);
-                if (r < 0)
-                        return r;
-                r = mac_selinux_unit_access_check(u, message, permission, error);
-                if (r < 0)
-                        return r;
-        }
-#endif
-        return 0;
-}