summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorWaLyong Cho <walyong.cho@samsung.com>2015-06-08 19:41:01 +0900
committerWaLyong Cho <walyong.cho@samsung.com>2015-06-22 23:44:09 +0900
commite174dce27173396ed8034c9cfda87eb210365126 (patch)
treec9fe8b256c739a5e88866396f3a0132e90f3a7b6 /src
parent6656aefb42385b468dd96867118d049f945cbf81 (diff)
smack: add default smack process label config
Similar to SmackProcessLabel=, if this configuration is set, systemd executes processes with given SMACK label. If unit has SmackProcessLabel=, this config is overwritten. But, do NOT be confused with SMACK64EXEC of execute file. This default execute process label(and also label which is set by SmackProcessLabel=) is set fork-ed process SMACK subject label and used to access the execute file. If the execution file has also SMACK64EXEC, finally executed process has SMACK64EXEC subject. While if the execution file has no SMACK64EXEC, the executed process has label of this config(or label which is set by SmackProcessLabel=). Because if execution file has no SMACK64EXEC then excuted process inherits label from caller process(in this case, the caller is systemd).
Diffstat (limited to 'src')
-rw-r--r--src/core/execute.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/core/execute.c b/src/core/execute.c
index 94cc101738..c92db51330 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1717,6 +1717,15 @@ static int exec_child(
return r;
}
}
+#ifdef SMACK_DEFAULT_PROCESS_LABEL
+ else {
+ r = mac_smack_apply_pid(0, SMACK_DEFAULT_PROCESS_LABEL);
+ if (r < 0) {
+ *exit_status = EXIT_SMACK_PROCESS_LABEL;
+ return r;
+ }
+ }
+#endif
#endif
if (context->user) {