summaryrefslogtreecommitdiff
path: root/src/socket-util.c
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2010-07-28 09:39:54 -0400
committerLennart Poettering <lennart@poettering.net>2010-08-03 23:45:22 +0200
commit56cf987fe74270bde4e16c7ec9e0414a9030723b (patch)
treeba36afd8f8da67dd0ed744997a2e4167e2883cc6 /src/socket-util.c
parent8b33e5ca72def2b79ffcd9b7e96f8f40f6bd4a20 (diff)
Systemd is causing mislabeled devices to be created and then attempting to read them.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/28/2010 05:57 AM, Kay Sievers wrote: > On Wed, Jul 28, 2010 at 11:43, Lennart Poettering > <lennart@poettering.net> wrote: >> On Mon, 26.07.10 16:42, Daniel J Walsh (dwalsh@redhat.com) wrote: >>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file >>> type=1400 audit(1280174589.476:7): avc: denied { read } for pid=1 >>> comm="systemd" name="autofs" dev=devtmpfs ino=9482 >>> scontext=system_u:system_r:init_t:s0 >>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file >>> type=1400 audit(1280174589.476:8): avc: denied { read } for pid=1 >>> comm="systemd" name="autofs" dev=devtmpfs ino=9482 >>> scontext=system_u:system_r:init_t:s0 >>> tcontext=system_u:object_r:device_t:s0 tclass=chr_file >>> >>> Lennart, we talked about this earlier. I think this is caused by the >>> modprobe calls to create /dev/autofs. Since udev is not created at the >>> point that init loads the kernel modules, the devices get created with >>> the wrong label. Once udev starts the labels get fixed. >>> >>> I can allow init_t to read device_t chr_files. >> >> Hmm, I think a cleaner fix would be to make systemd relabel this device >> properly before accessing it? Given that this is only one device this >> should not be a problem for us to maintain, I think? How would the >> fixing of the label work? Would we have to spawn restorecon for this, or >> can we actually do this in C without too much work? > > I guess we can just do what udev is doing, and call setfilecon(), with > a context of an earlier matchpathcon(). > > Kay > _______________________________________________ > systemd-devel mailing list > systemd-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/systemd-devel Here is the updated patch with a fix for the labeling of /dev/autofs -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxQMyoACgkQrlYvE4MpobNviACfWgxsjW2xzz1qznFex8RVAQHf gIEAmwRmRcLvGqYtwQaZ3WKIg8wmrwNk =pC2e
Diffstat (limited to 'src/socket-util.c')
-rw-r--r--src/socket-util.c13
1 files changed, 5 insertions, 8 deletions
diff --git a/src/socket-util.c b/src/socket-util.c
index 3a00fcf43f..2af8563965 100644
--- a/src/socket-util.c
+++ b/src/socket-util.c
@@ -29,7 +29,6 @@
#include <net/if.h>
#include <sys/types.h>
#include <sys/stat.h>
-#include <selinux/selinux.h>
#include "macro.h"
#include "util.h"
@@ -306,7 +305,7 @@ int socket_address_listen(
bool free_bind,
mode_t directory_mode,
mode_t socket_mode,
- security_context_t scon,
+ const char *label,
int *ret) {
int r, fd, one;
@@ -316,16 +315,14 @@ int socket_address_listen(
if ((r = socket_address_verify(a)) < 0)
return r;
- if (setsockcreatecon(scon) < 0) {
- log_error("Failed to set SELinux context (%s) on socket: %m", scon);
- if (security_getenforce() == 1)
- return -errno;
- }
+ r = label_socket_set(label);
+ if (r < 0)
+ return r;
fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0);
r = fd < 0 ? -errno : 0;
- setsockcreatecon(NULL);
+ label_socket_clear();
if (r < 0)
return r;