From e174dce27173396ed8034c9cfda87eb210365126 Mon Sep 17 00:00:00 2001 From: WaLyong Cho Date: Mon, 8 Jun 2015 19:41:01 +0900 Subject: smack: add default smack process label config Similar to SmackProcessLabel=, if this configuration is set, systemd executes processes with given SMACK label. If unit has SmackProcessLabel=, this config is overwritten. But, do NOT be confused with SMACK64EXEC of execute file. This default execute process label(and also label which is set by SmackProcessLabel=) is set fork-ed process SMACK subject label and used to access the execute file. If the execution file has also SMACK64EXEC, finally executed process has SMACK64EXEC subject. While if the execution file has no SMACK64EXEC, the executed process has label of this config(or label which is set by SmackProcessLabel=). Because if execution file has no SMACK64EXEC then excuted process inherits label from caller process(in this case, the caller is systemd). --- configure.ac | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'configure.ac') diff --git a/configure.ac b/configure.ac index 8b1e275d27..88b52c45fe 100644 --- a/configure.ac +++ b/configure.ac @@ -673,8 +673,14 @@ fi AC_ARG_WITH(smack-run-label, AS_HELP_STRING([--with-smack-run-label=STRING], - [run systemd --system with a specific SMACK label]), - [AC_DEFINE_UNQUOTED(SMACK_RUN_LABEL, ["$withval"], [Run with a smack label])], + [run systemd --system itself with a specific SMACK label]), + [AC_DEFINE_UNQUOTED(SMACK_RUN_LABEL, ["$withval"], [Run systemd itself with SMACK label])], + []) + +AC_ARG_WITH(smack-default-process-label, +AS_HELP_STRING([--with-smack-default-process-label=STRING], + [default SMACK label for executed processes]), + [AC_DEFINE_UNQUOTED(SMACK_DEFAULT_PROCESS_LABEL, ["$withval"], [Default SMACK label for executed processes])], []) if test "x${have_smack}" = xyes ; then -- cgit v1.2.3-54-g00ecf