summaryrefslogtreecommitdiff
path: root/src/udev
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2013-10-10 16:35:44 +0200
committerLennart Poettering <lennart@poettering.net>2013-10-10 16:35:44 +0200
commitd682b3a7e7c7c2941a4d3e193f1e330dbc9fae89 (patch)
treef9e0c1c2af7b0756af89db0864a0708076a55144 /src/udev
parent0581dac2c146cef0f55841a4c136dc48409c8eaa (diff)
security: rework selinux, smack, ima, apparmor detection logic
Always cache the results, and bypass low-level security calls when the respective subsystem is not enabled.
Diffstat (limited to 'src/udev')
-rw-r--r--src/udev/udev-node.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 187e24e5b6..c5d629d1ce 100644
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -32,6 +32,7 @@
#include <attr/xattr.h>
#endif
+#include "smack-util.h"
#include "udev.h"
static int node_symlink(struct udev_device *dev, const char *node, const char *slink)
@@ -311,7 +312,7 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
log_debug("SECLABEL: set SELinux label '%s'", label);
#ifdef HAVE_SMACK
- } else if (streq(name, "smack")) {
+ } else if (streq(name, "smack") && use_smack()) {
smack = true;
if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0)
log_error("SECLABEL: failed to set SMACK label '%s'", label);
@@ -327,7 +328,7 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
if (!selinux)
label_fix(devnode, true, false);
#ifdef HAVE_SMACK
- if (!smack)
+ if (!smack && use_smack())
lremovexattr(devnode, "security.SMACK64");
#endif
}