diff options
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/condition.c | 29 | ||||
| -rw-r--r-- | src/core/socket.c | 6 |
2 files changed, 11 insertions, 24 deletions
diff --git a/src/core/condition.c b/src/core/condition.c index 6c387450af..c53d406682 100644 --- a/src/core/condition.c +++ b/src/core/condition.c @@ -27,10 +27,6 @@ #include <sys/statvfs.h> #include <fnmatch.h> -#ifdef HAVE_SELINUX -#include <selinux/selinux.h> -#endif - #include <systemd/sd-id128.h> #include "util.h" #include "condition.h" @@ -38,6 +34,10 @@ #include "path-util.h" #include "fileio.h" #include "unit.h" +#include "smack-util.h" +#include "apparmor-util.h" +#include "ima-util.h" +#include "selinux-util.h" Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) { Condition *c; @@ -158,28 +158,15 @@ static bool test_virtualization(const char *parameter) { return v > 0 && streq(parameter, id); } -static bool test_apparmor_enabled(void) { - int r; - _cleanup_free_ char *p = NULL; - - r = read_one_line_file("/sys/module/apparmor/parameters/enabled", &p); - if (r < 0) - return false; - - return parse_boolean(p) > 0; -} - static bool test_security(const char *parameter) { -#ifdef HAVE_SELINUX if (streq(parameter, "selinux")) - return is_selinux_enabled() > 0; -#endif + return use_selinux(); if (streq(parameter, "apparmor")) - return test_apparmor_enabled(); + return use_apparmor(); if (streq(parameter, "ima")) - return access("/sys/kernel/security/ima/", F_OK) == 0; + return use_ima(); if (streq(parameter, "smack")) - return access("/sys/fs/smackfs", F_OK) == 0; + return use_smack(); return false; } diff --git a/src/core/socket.c b/src/core/socket.c index 6c0ac1a898..345601f0ae 100644 --- a/src/core/socket.c +++ b/src/core/socket.c @@ -775,12 +775,12 @@ static void socket_apply_socket_options(Socket *s, int fd) { } #ifdef HAVE_SMACK - if (s->smack_ip_in) + if (s->smack_ip_in && use_smack()) if (fsetxattr(fd, "security.SMACK64IPIN", s->smack_ip_in, strlen(s->smack_ip_in), 0) < 0) log_error_unit(UNIT(s)->id, "fsetxattr(\"security.SMACK64IPIN\"): %m"); - if (s->smack_ip_out) + if (s->smack_ip_out && use_smack()) if (fsetxattr(fd, "security.SMACK64IPOUT", s->smack_ip_out, strlen(s->smack_ip_out), 0) < 0) log_error_unit(UNIT(s)->id, "fsetxattr(\"security.SMACK64IPOUT\"): %m"); @@ -797,7 +797,7 @@ static void socket_apply_fifo_options(Socket *s, int fd) { "F_SETPIPE_SZ: %m"); #ifdef HAVE_SMACK - if (s->smack) + if (s->smack && use_smack()) if (fsetxattr(fd, "security.SMACK64", s->smack, strlen(s->smack), 0) < 0) log_error_unit(UNIT(s)->id, "fsetxattr(\"security.SMACK64\"): %m"); |