~lukeshu/systemd - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author
2014-11-24	smack: introduce new SmackProcessLabel option	WaLyong Cho
	In service file, if the file has some of special SMACK label in ExecStart= and systemd has no permission for the special SMACK label then permission error will occurred. To resolve this, systemd should be able to set its SMACK label to something accessible of ExecStart=. So introduce new SmackProcessLabel. If label is specified with SmackProcessLabel= then the child systemd will set its label to that. To successfully execute the ExecStart=, accessible label should be specified with SmackProcessLabel=. Additionally, by SMACK policy, if the file in ExecStart= has no SMACK64EXEC then the executed process will have given label by SmackProcessLabel=. But if the file has SMACK64EXEC then the SMACK64EXEC label will be overridden. [zj: reword man page]
2014-10-23	smack: we don't need the special labels exported, hence don't	Lennart Poettering

2014-10-23	smack: rework SMACK label fixing code to follow more closely the semantics ↵	Lennart Poettering
	of the matching selinux code
2014-10-23	smack: never follow symlinks when relabelling	Lennart Poettering
	previously mac_smack_apply(path, NULL) would operate on the symlink itself while mac_smack_apply(path, "foo") would follow the symlink. Let's clean this up an always operate on the symlink, which appears to be the safer option.
2014-10-23	smack: rework smack APIs a bit	Lennart Poettering
	a) always return negative errno error codes b) always become a noop if smack is off c) always take a NULL label as a request to remove it
2014-10-23	mac: rename all calls that apply a label mac_{selinux\|smack}_apply_xyz(), ↵	Lennart Poettering
	and all that reset it to defaults mac_{selinux\|smack}_fix() Let's clean up the naming schemes a bit and use the same one for SMACK and for SELINUX.
2014-10-23	mac: also rename use_{smack,selinux,apparmor}() calls so that they share the ↵	Lennart Poettering
	new mac_{smack,selinux,apparmor}_xyz() convention
2014-10-23	mac: rename apis with mac_{selinux/smack}_ prefix	WaLyong Cho

2014-10-23	label: rearrange mandatory access control(MAC) apis	WaLyong Cho
	move label apis to selinux-util.ch or smack-util.ch appropriately.
2014-05-28	build-sys: use glibc's xattr support instead of requiring libattr	Kay Sievers

2013-10-11	smack: minimize ifdef use, and move all labeling to smack-util.c	Kay Sievers

2013-10-10	security: rework selinux, smack, ima, apparmor detection logic	Lennart Poettering
	Always cache the results, and bypass low-level security calls when the respective subsystem is not enabled.
2013-10-09	Smack: Test if smack is enabled before mounting	Auke Kok
	Since on most systems with xattr systemd will compile with Smack support enabled, we still attempt to mount various fs's with Smack-only options. Before mounting any of these Smack-related filesystems with Smack specific mount options, check if Smack is functionally active on the running kernel. If Smack is really enabled in the kernel, all these Smack mounts are now fatal, as they should be. We no longer mount smackfs if systemd was compiled without Smack support. This makes it easier to make smackfs mount failures a critical error when Smack is enabled. We no longer mount these filesystems with their Smack specific options inside containers. There these filesystems will be mounted with there non-mount smack options for now.