diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-01-09 19:36:26 -0500 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2014-01-09 19:36:26 -0500 |
| commit | b51ff2cd4aee8033f8d3f4bb8eb9eb7035737152 (patch) | |
| tree | 3ebe72403fb96eb0c011be72a15b88cdd9eb8a66 /src/udev/udev-node.c | |
| parent | 97b903d94eca5cc6cf17262f91e43227998d3301 (diff) | |
security: rework selinux, smack, ima, apparmor detection logic
Always cache the results, and bypass low-level security calls when
the respective subsystem is not enabled.
Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
Diffstat (limited to 'src/udev/udev-node.c')
| -rw-r--r-- | src/udev/udev-node.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c index 76644ccdba..361068dd67 100644 --- a/src/udev/udev-node.c +++ b/src/udev/udev-node.c @@ -32,6 +32,7 @@ #include <attr/xattr.h> #endif +#include "smack-util.h" #include "udev.h" static int node_symlink(struct udev_device *dev, const char *node, const char *slink) @@ -312,7 +313,7 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, log_debug("SECLABEL: set SELinux label '%s'", label); #ifdef HAVE_SMACK - } else if (streq(name, "smack")) { + } else if (streq(name, "smack") && use_smack()) { smack = true; if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0) log_error("SECLABEL: failed to set SMACK label '%s'", label); @@ -328,7 +329,7 @@ static int node_permissions_apply(struct udev_device *dev, bool apply, if (!selinux) label_fix(devnode, true, false); #ifdef HAVE_SMACK - if (!smack) + if (!smack && use_smack()) lremovexattr(devnode, "security.SMACK64"); #endif } |