From 9008e1ac925afcdef7b45042c03fa5444f1c52c2 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Wed, 12 Nov 2014 13:53:27 +0100 Subject: selinux: figure out selinux context applied on exec() before closing all fds We need original socket_fd around otherwise mac_selinux_get_child_mls_label fails with -EINVAL return code. Also don't call setexeccon twice but rather pass context value of SELinuxContext option as an extra argument. --- src/shared/selinux-util.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/shared/selinux-util.h') diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h index 7ff8c607b4..a694441000 100644 --- a/src/shared/selinux-util.h +++ b/src/shared/selinux-util.h @@ -36,7 +36,7 @@ int mac_selinux_apply(const char *path, const char *label); int mac_selinux_get_create_label_from_exe(const char *exe, char **label); int mac_selinux_get_our_label(char **label); -int mac_selinux_get_child_mls_label(int socket_fd, const char *exec, char **label); +int mac_selinux_get_child_mls_label(int socket_fd, const char *exe, const char *exec_label, char **label); void mac_selinux_free(char *label); int mac_selinux_create_file_prepare(const char *path, mode_t mode); -- cgit v1.2.3-54-g00ecf