diff options
Diffstat (limited to 'src/socket-util.c')
| -rw-r--r-- | src/socket-util.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/src/socket-util.c b/src/socket-util.c index 442abfe1af..3a00fcf43f 100644 --- a/src/socket-util.c +++ b/src/socket-util.c @@ -29,6 +29,7 @@ #include <net/if.h> #include <sys/types.h> #include <sys/stat.h> +#include <selinux/selinux.h> #include "macro.h" #include "util.h" @@ -305,7 +306,7 @@ int socket_address_listen( bool free_bind, mode_t directory_mode, mode_t socket_mode, - /* FIXME SELINUX: pass SELinux context object here */ + security_context_t scon, int *ret) { int r, fd, one; @@ -315,11 +316,19 @@ int socket_address_listen( if ((r = socket_address_verify(a)) < 0) return r; - /* FIXME SELINUX: The socket() here should be done with the - * right SELinux context set */ + if (setsockcreatecon(scon) < 0) { + log_error("Failed to set SELinux context (%s) on socket: %m", scon); + if (security_getenforce() == 1) + return -errno; + } + + fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0); + r = fd < 0 ? -errno : 0; + + setsockcreatecon(NULL); - if ((fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0)) < 0) - return -errno; + if (r < 0) + return r; if (socket_address_family(a) == AF_INET6 && only != SOCKET_ADDRESS_DEFAULT) { int flag = only == SOCKET_ADDRESS_IPV6_ONLY; |