diff options
| -rw-r--r-- | src/mount-setup.c | 18 | ||||
| -rw-r--r-- | src/selinux-setup.c | 10 |
2 files changed, 27 insertions, 1 deletions
diff --git a/src/mount-setup.c b/src/mount-setup.c index fe99f58b66..84a729ebf2 100644 --- a/src/mount-setup.c +++ b/src/mount-setup.c @@ -27,6 +27,7 @@ #include <libgen.h> #include <assert.h> #include <unistd.h> +#include <ftw.h> #include "mount-setup.h" #include "log.h" @@ -189,6 +190,16 @@ static int symlink_and_label(const char *old_path, const char *new_path) { return r; } +static int nftw_cb( + const char *fpath, + const struct stat *sb, + int tflag, + struct FTW *ftwbuf) { + + label_fix(fpath); + return 0; +}; + int mount_setup(void) { const char *symlinks = @@ -207,6 +218,13 @@ int mount_setup(void) { if ((r = mount_one(mount_table+i)) < 0) return r; + /* Nodes in devtmpfs need to be manually updated for the + * appropriate labels, after mounting. The other virtual API + * file systems do not need. */ + + if (unlink("/dev/.systemd/relabel-devtmpfs") >= 0) + nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS); + /* Create a few default symlinks, which are normally created * bei udevd, but some scripts might need them before we start * udevd. */ diff --git a/src/selinux-setup.c b/src/selinux-setup.c index d4da693ca4..b2beb33d1f 100644 --- a/src/selinux-setup.c +++ b/src/selinux-setup.c @@ -42,8 +42,14 @@ int selinux_setup(char *const argv[]) { if (path_is_mount_point("/selinux") > 0) return 0; + /* Before we load the policy we create a flag file to ensure + * that after the reexec we iterate through /dev to relabel + * things. */ + mkdir_p("/dev/.systemd", 0755); + touch("/dev/.systemd/relabel-devtmpfs"); + if (selinux_init_load_policy(&enforce) == 0) { - log_info("Successfully loaded SELinux policy, reexecuting."); + log_debug("Successfully loaded SELinux policy, reexecuting."); /* FIXME: Ideally we'd just call setcon() here instead * of having to reexecute ourselves here. */ @@ -55,6 +61,8 @@ int selinux_setup(char *const argv[]) { } else { log_full(enforce > 0 ? LOG_ERR : LOG_DEBUG, "Failed to load SELinux policy."); + unlink("/dev/.systemd/relabel-devtmpfs"); + if (enforce > 0) return -EIO; } |