diff options
| -rw-r--r-- | src/label.c | 37 | ||||
| -rw-r--r-- | src/label.h | 2 | ||||
| -rw-r--r-- | src/socket.c | 19 |
3 files changed, 19 insertions, 39 deletions
diff --git a/src/label.c b/src/label.c index 21e7ee6ac8..8b807847fd 100644 --- a/src/label.c +++ b/src/label.c @@ -41,31 +41,6 @@ static inline bool use_selinux(void) { return use_selinux_ind; } -static int label_get_file_label_from_path( - const char *label, - const char *path, - const char *class, - security_context_t *fcon) { - - security_context_t dir_con = NULL; - security_class_t sclass; - int r = 0; - - r = getfilecon(path, &dir_con); - if (r >= 0) { - r = -1; - errno = EINVAL; - - if ((sclass = string_to_security_class(class)) != 0) - r = security_compute_create((security_context_t) label, dir_con, sclass, fcon); - } - if (r < 0) - r = -errno; - - freecon(dir_con); - return r; -} - #endif int label_init(void) { @@ -80,7 +55,7 @@ int label_init(void) { if (!label_hnd) { log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, "Failed to initialize SELinux context: %m"); - r = (security_getenforce() == 1) ? -errno : 0; + r = security_getenforce() == 1 ? -errno : 0; } #endif @@ -109,7 +84,7 @@ int label_fix(const char *path) { if (r < 0) { log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, "Unable to fix label of %s: %m", path); - r = (security_getenforce() == 1) ? -errno : 0; + r = security_getenforce() == 1 ? -errno : 0; } #endif @@ -161,18 +136,18 @@ fail: return r; } -int label_fifofile_set(const char *label, const char *path) { +int label_fifofile_set(const char *path) { int r = 0; #ifdef HAVE_SELINUX security_context_t filecon = NULL; - if (!use_selinux() || !label) + if (!use_selinux() || !label_hnd) return 0; - if (((r = label_get_file_label_from_path(label, path, "fifo_file", &filecon)) == 0)) { + if ((r = selabel_lookup_raw(label_hnd, &filecon, path, S_IFIFO)) == 0) { if ((r = setfscreatecon(filecon)) < 0) { - log_error("Failed to set SELinux file context (%s) on %s: %m", label, path); + log_error("Failed to set SELinux file context on %s: %m", path); r = -errno; } diff --git a/src/label.h b/src/label.h index 95a2829acf..0c59da1f1c 100644 --- a/src/label.h +++ b/src/label.h @@ -32,7 +32,7 @@ int label_fix(const char *path); int label_socket_set(const char *label); void label_socket_clear(void); -int label_fifofile_set(const char *label, const char *path); +int label_fifofile_set(const char *path); void label_file_clear(void); void label_free(const char *label); diff --git a/src/socket.c b/src/socket.c index 7510a6d6de..d0568c9b52 100644 --- a/src/socket.c +++ b/src/socket.c @@ -724,15 +724,10 @@ static int socket_open_fds(Socket *s) { SocketPort *p; int r; char *label = NULL; + bool know_label = false; assert(s); - if ((r = socket_instantiate_service(s)) < 0) - return r; - - if ((r = label_get_socket_label_from_exe(s->service->exec_command[SERVICE_EXEC_START]->path, &label)) < 0) - return r; - LIST_FOREACH(port, p, s->ports) { if (p->fd >= 0) @@ -740,6 +735,17 @@ static int socket_open_fds(Socket *s) { if (p->type == SOCKET_SOCKET) { + if (!know_label) { + + if ((r = socket_instantiate_service(s)) < 0) + return r; + + if ((r = label_get_socket_label_from_exe(s->service->exec_command[SERVICE_EXEC_START]->path, &label)) < 0) + return r; + + know_label = true; + } + if ((r = socket_address_listen( &p->address, s->backlog, @@ -760,7 +766,6 @@ static int socket_open_fds(Socket *s) { p->path, s->directory_mode, s->socket_mode, - label, &p->fd)) < 0) goto rollback; |