selinux: close stdin/stdout/stderr before loading selinux policy

Let's make sure libselinux doesn't spew to stderr

2 files changed, 3 insertions, 4 deletions

diff --git a/src/core/main.c b/src/core/main.c
index 33c0692c71..458fdca55e 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1266,6 +1266,8 @@ int main(int argc, char *argv[]) {
                 }
 
                 arg_running_as = MANAGER_SYSTEM;
+
+                make_null_stdio();
                 log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_JOURNAL : LOG_TARGET_JOURNAL_OR_KMSG);
 
                 if (!skip_setup) {
@@ -1439,10 +1441,8 @@ int main(int argc, char *argv[]) {
 
         /* Reset the console, but only if this is really init and we
          * are freshly booted */
-        if (arg_running_as == MANAGER_SYSTEM && arg_action == ACTION_RUN) {
+        if (arg_running_as == MANAGER_SYSTEM && arg_action == ACTION_RUN)
                 console_setup(getpid() == 1 && !skip_setup);
-                make_null_stdio();
-        }
 
         /* Open the logging devices, if possible and necessary */
         log_open();
diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c
index fa025b7268..52df7a7221 100644
--- a/src/core/selinux-setup.c
+++ b/src/core/selinux-setup.c
@@ -79,7 +79,6 @@ int selinux_setup(bool *loaded_policy) {
        /* Now load the policy */
        before_load = now(CLOCK_MONOTONIC);
        r = selinux_init_load_policy(&enforce);
-
        if (r == 0) {
                char timespan[FORMAT_TIMESPAN_MAX];
                char *label;