summaryrefslogtreecommitdiff
path: root/src/udev/udev-node.c
diff options
context:
space:
mode:
authorKay Sievers <kay@vrfy.org>2013-10-09 04:17:39 +0200
committerAnthony G. Basile <blueness@gentoo.org>2014-01-09 18:48:25 -0500
commited55ef29406d173fb838211c31058e7941c09d00 (patch)
tree7ec61c1d2a39456fe446cb549cc9905ef888817f /src/udev/udev-node.c
parent87539be4377dd8a3c6be306b6552e2111d09d735 (diff)
udev: reset Linux Security Module labels if no custom rules are given
Signed-off-by: Anthony G. Basile <blueness@gentoo.org>
Diffstat (limited to 'src/udev/udev-node.c')
-rw-r--r--src/udev/udev-node.c19
1 files changed, 16 insertions, 3 deletions
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 53529de4a7..e09c94dedb 100644
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -283,6 +283,11 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
}
if (apply) {
+ bool selinux = false;
+#ifdef HAVE_SMACK
+ bool smack = false;
+#endif
+
if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) {
log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
chmod(devnode, mode);
@@ -292,8 +297,6 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
}
- label_fix(devnode, true, false);
-
/* apply SECLABEL{$module}=$label */
udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) {
const char *name, *label;
@@ -302,11 +305,13 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
label = udev_list_entry_get_value(entry);
if (streq(name, "selinux")) {
+ selinux = true;
/* FIXME: hook up libselinux */
log_error("SECLABEL: failed to set selinux label '%s'", label);
+#ifdef HAVE_SMACK
} else if (streq(name, "smack")) {
-#ifdef HAVE_XATTR
+ smack = true;
if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0)
log_error("SECLABEL: failed to set SMACK label '%s'", label);
else
@@ -316,6 +321,14 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
} else
log_error("SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
}
+
+ /* set the defaults */
+ if (!selinux)
+ label_fix(devnode, true, false);
+#ifdef HAVE_SMACK
+ if (!smack)
+ lremovexattr(devnode, "security.SMACK64");
+#endif
}
/* always update timestamp when we re-use the node, like on media change events */