socket: introduce SELinuxContextFromNet option

This makes possible to spawn service instances triggered by socket with
MLS/MCS SELinux labels which are created based on information provided by
connected peer.

Implementation of label_get_child_mls_label derived from xinetd.

Reviewed-by: Paul Moore <pmoore@redhat.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/src/core/service.c b/src/core/service.c
index 3f6595c5c8..395e0ca8c6 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -901,6 +901,7 @@ static int service_spawn(
                 .apply_chroot      = apply_chroot,
                 .apply_tty_stdin   = apply_tty_stdin,
                 .bus_endpoint_fd   = -1,
+                .selinux_context_net = s->socket_fd_selinux_context_net
         };
 
         assert(s);
@@ -2748,7 +2749,7 @@ static void service_bus_name_owner_change(
         }
 }
 
-int service_set_socket_fd(Service *s, int fd, Socket *sock) {
+int service_set_socket_fd(Service *s, int fd, Socket *sock, bool selinux_context_net) {
         _cleanup_free_ char *peer = NULL;
         int r;
 
@@ -2786,6 +2787,7 @@ int service_set_socket_fd(Service *s, int fd, Socket *sock) {
         }
 
         s->socket_fd = fd;
+        s->socket_fd_selinux_context_net = selinux_context_net;
 
         unit_ref_set(&s->accept_socket, UNIT(sock));