From 5ce04ca64c9cab96901f3eb6f6000aabf5d17e43 Mon Sep 17 00:00:00 2001 From: Michal Schmidt Date: Thu, 6 Nov 2014 16:48:11 +0100 Subject: shared: create files even if the SELinux policy has no context for them The SELinux policy defines no context for some files. E.g.: $ matchpathcon /run/lock/subsys /dev/mqueue /run/lock/subsys <> /dev/mqueue <> We still need to be able to create them. In this case selabel_lookup_raw() returns ENOENT. We should then skip setfscreatecon(), but still return success. It was broken since c34255bdb2 ("label: unify code to make directories, symlinks"). Signed-off-by: Anthony G. Basile --- src/shared/selinux-util.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index e2ccef2865..a374c277a8 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -330,9 +330,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) { r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode); } - if (r < 0 && errno != ENOENT) + /* No context specified by the policy? Proceed without setting it. */ + if (r < 0 && errno == ENOENT) + return 0; + + if (r < 0) r = -errno; - else if (r == 0) { + else { r = setfscreatecon(filecon); if (r < 0) { log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path); -- cgit v1.2.3-54-g00ecf