From 2ca620c4ed28c01f285d869d0b22f22a360957da Mon Sep 17 00:00:00 2001 From: WaLyong Cho Date: Mon, 24 Nov 2014 20:46:20 +0900 Subject: smack: introduce new SmackProcessLabel option In service file, if the file has some of special SMACK label in ExecStart= and systemd has no permission for the special SMACK label then permission error will occurred. To resolve this, systemd should be able to set its SMACK label to something accessible of ExecStart=. So introduce new SmackProcessLabel. If label is specified with SmackProcessLabel= then the child systemd will set its label to that. To successfully execute the ExecStart=, accessible label should be specified with SmackProcessLabel=. Additionally, by SMACK policy, if the file in ExecStart= has no SMACK64EXEC then the executed process will have given label by SmackProcessLabel=. But if the file has SMACK64EXEC then the SMACK64EXEC label will be overridden. [zj: reword man page] --- src/shared/smack-util.h | 1 + 1 file changed, 1 insertion(+) (limited to 'src/shared/smack-util.h') diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h index 68778da38b..50f55b1f4b 100644 --- a/src/shared/smack-util.h +++ b/src/shared/smack-util.h @@ -31,5 +31,6 @@ int mac_smack_fix(const char *path, bool ignore_enoent, bool ignore_erofs); int mac_smack_apply(const char *path, const char *label); int mac_smack_apply_fd(int fd, const char *label); +int mac_smack_apply_pid(pid_t pid, const char *label); int mac_smack_apply_ip_in_fd(int fd, const char *label); int mac_smack_apply_ip_out_fd(int fd, const char *label); -- cgit v1.2.3-54-g00ecf