diff options
| author | Lennart Poettering <lennart@poettering.net> | 2013-10-10 16:35:44 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2013-10-10 16:35:44 +0200 |
| commit | d682b3a7e7c7c2941a4d3e193f1e330dbc9fae89 (patch) | |
| tree | f9e0c1c2af7b0756af89db0864a0708076a55144 /src/journal/journald-server.c | |
| parent | 0581dac2c146cef0f55841a4c136dc48409c8eaa (diff) | |
security: rework selinux, smack, ima, apparmor detection logic
Always cache the results, and bypass low-level security calls when the
respective subsystem is not enabled.
Diffstat (limited to 'src/journal/journald-server.c')
| -rw-r--r-- | src/journal/journald-server.c | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index e03e413aef..9732e1b25e 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -629,19 +629,21 @@ static void dispatch_message_real( } #ifdef HAVE_SELINUX - if (label) { - x = alloca(sizeof("_SELINUX_CONTEXT=") + label_len); + if (use_selinux()) { + if (label) { + x = alloca(sizeof("_SELINUX_CONTEXT=") + label_len); - *((char*) mempcpy(stpcpy(x, "_SELINUX_CONTEXT="), label, label_len)) = 0; - IOVEC_SET_STRING(iovec[n++], x); - } else { - security_context_t con; + *((char*) mempcpy(stpcpy(x, "_SELINUX_CONTEXT="), label, label_len)) = 0; + IOVEC_SET_STRING(iovec[n++], x); + } else { + security_context_t con; - if (getpidcon(ucred->pid, &con) >= 0) { - x = strappenda("_SELINUX_CONTEXT=", con); + if (getpidcon(ucred->pid, &con) >= 0) { + x = strappenda("_SELINUX_CONTEXT=", con); - freecon(con); - IOVEC_SET_STRING(iovec[n++], x); + freecon(con); + IOVEC_SET_STRING(iovec[n++], x); + } } } #endif |