diff options
| author | Kay Sievers <kay@vrfy.org> | 2013-10-09 04:17:39 +0200 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2014-01-09 18:48:25 -0500 |
| commit | ed55ef29406d173fb838211c31058e7941c09d00 (patch) | |
| tree | 7ec61c1d2a39456fe446cb549cc9905ef888817f /src/udev/udev-node.c | |
| parent | 87539be4377dd8a3c6be306b6552e2111d09d735 (diff) | |
udev: reset Linux Security Module labels if no custom rules are given
Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
Diffstat (limited to 'src/udev/udev-node.c')
| -rw-r--r-- | src/udev/udev-node.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c index 53529de4a7..e09c94dedb 100644 --- a/src/udev/udev-node.c +++ b/src/udev/udev-node.c @@ -283,6 +283,11 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, } if (apply) { + bool selinux = false; +#ifdef HAVE_SMACK + bool smack = false; +#endif + if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) { log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid); chmod(devnode, mode); @@ -292,8 +297,6 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid); } - label_fix(devnode, true, false); - /* apply SECLABEL{$module}=$label */ udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) { const char *name, *label; @@ -302,11 +305,13 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, label = udev_list_entry_get_value(entry); if (streq(name, "selinux")) { + selinux = true; /* FIXME: hook up libselinux */ log_error("SECLABEL: failed to set selinux label '%s'", label); +#ifdef HAVE_SMACK } else if (streq(name, "smack")) { -#ifdef HAVE_XATTR + smack = true; if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0) log_error("SECLABEL: failed to set SMACK label '%s'", label); else @@ -316,6 +321,14 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, } else log_error("SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label); } + + /* set the defaults */ + if (!selinux) + label_fix(devnode, true, false); +#ifdef HAVE_SMACK + if (!smack) + lremovexattr(devnode, "security.SMACK64"); +#endif } /* always update timestamp when we re-use the node, like on media change events */ |