From 5364c68690d5a25b6dcc4b49534d88af78966f3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 19 Dec 2017 09:21:02 +0100 Subject: [PATCH 1/4] bootctl: silence warning about signed/unsigned comparison --- src/boot/bootctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/boot/bootctl.c b/src/boot/bootctl.c index 525470f096..48fdf97c7f 100644 --- a/src/boot/bootctl.c +++ b/src/boot/bootctl.c @@ -1043,7 +1043,7 @@ static int verb_list(int argc, char *argv[], void *userdata) { boot_entry_title(e), ansi_normal(), ansi_highlight_green(), - n == config.default_entry ? " (default)" : "", + n == (unsigned) config.default_entry ? " (default)" : "", ansi_normal()); if (e->version) printf(" version: %s\n", e->version); From d49a7143fcf5693f317d484ebbe92ecece99d086 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 19 Dec 2017 10:02:27 +0100 Subject: [PATCH 2/4] =?UTF-8?q?machine-id-setup:=20use=20return=20log=5Fer?= =?UTF-8?q?ror=E2=80=A6=20pattern?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No functional difference, but this way it's clearer that the original errno value is returned. --- src/core/machine-id-setup.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c index 767e97206c..1b7424800c 100644 --- a/src/core/machine-id-setup.c +++ b/src/core/machine-id-setup.c @@ -119,16 +119,15 @@ int machine_id_setup(const char *root, sd_id128_t machine_id, sd_id128_t *ret) { fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY); if (fd < 0) { if (old_errno == EROFS && errno == ENOENT) - log_error_errno(errno, + return log_error_errno(errno, "System cannot boot: Missing /etc/machine-id and /etc is mounted read-only.\n" "Booting up is supported only when:\n" "1) /etc/machine-id exists and is populated.\n" "2) /etc/machine-id exists and is empty.\n" "3) /etc/machine-id is missing and /etc is writable.\n"); else - log_error_errno(errno, "Cannot open %s: %m", etc_machine_id); - - return -errno; + return log_error_errno(errno, + "Cannot open %s: %m", etc_machine_id); } writable = false; From de2e28d87d53e9a1a5b6892bed43b7c7ee93240b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 19 Dec 2017 14:33:11 +0100 Subject: [PATCH 3/4] Move selinux-related stuff from btrfs-util.c to label.c In preparation for future changes. --- src/basic/btrfs-util.c | 19 ------------------- src/basic/btrfs-util.h | 1 - src/basic/label.c | 19 +++++++++++++++++++ src/basic/label.h | 2 ++ src/shared/machine-pool.c | 1 + 5 files changed, 22 insertions(+), 20 deletions(-) diff --git a/src/basic/btrfs-util.c b/src/basic/btrfs-util.c index ac96e63531..f8d743b407 100644 --- a/src/basic/btrfs-util.c +++ b/src/basic/btrfs-util.c @@ -50,7 +50,6 @@ #include "missing.h" #include "path-util.h" #include "rm-rf.h" -#include "selinux-util.h" #include "smack-util.h" #include "sparse-endian.h" #include "stat-util.h" @@ -174,24 +173,6 @@ int btrfs_subvol_make(const char *path) { return 0; } -int btrfs_subvol_make_label(const char *path) { - int r; - - assert(path); - - r = mac_selinux_create_file_prepare(path, S_IFDIR); - if (r < 0) - return r; - - r = btrfs_subvol_make(path); - mac_selinux_create_file_clear(); - - if (r < 0) - return r; - - return mac_smack_fix(path, false, false); -} - int btrfs_subvol_set_read_only_fd(int fd, bool b) { uint64_t flags, nflags; struct stat st; diff --git a/src/basic/btrfs-util.h b/src/basic/btrfs-util.h index 2c78daa37b..952b3c26da 100644 --- a/src/basic/btrfs-util.h +++ b/src/basic/btrfs-util.h @@ -84,7 +84,6 @@ int btrfs_resize_loopback_fd(int fd, uint64_t size, bool grow_only); int btrfs_resize_loopback(const char *path, uint64_t size, bool grow_only); int btrfs_subvol_make(const char *path); -int btrfs_subvol_make_label(const char *path); int btrfs_subvol_snapshot_fd(int old_fd, const char *new_path, BtrfsSnapshotFlags flags); int btrfs_subvol_snapshot(const char *old_path, const char *new_path, BtrfsSnapshotFlags flags); diff --git a/src/basic/label.c b/src/basic/label.c index ce81d286ab..94a2458149 100644 --- a/src/basic/label.c +++ b/src/basic/label.c @@ -22,6 +22,7 @@ #include #include +#include "btrfs-util.h" #include "label.h" #include "macro.h" #include "selinux-util.h" @@ -81,3 +82,21 @@ int symlink_label(const char *old_path, const char *new_path) { return mac_smack_fix(new_path, false, false); } + +int btrfs_subvol_make_label(const char *path) { + int r; + + assert(path); + + r = mac_selinux_create_file_prepare(path, S_IFDIR); + if (r < 0) + return r; + + r = btrfs_subvol_make(path); + mac_selinux_create_file_clear(); + + if (r < 0) + return r; + + return mac_smack_fix(path, false, false); +} diff --git a/src/basic/label.h b/src/basic/label.h index 86447c2e98..d73dacec4f 100644 --- a/src/basic/label.h +++ b/src/basic/label.h @@ -27,3 +27,5 @@ int label_fix(const char *path, bool ignore_enoent, bool ignore_erofs); int mkdir_label(const char *path, mode_t mode); int symlink_label(const char *old_path, const char *new_path); + +int btrfs_subvol_make_label(const char *path); diff --git a/src/shared/machine-pool.c b/src/shared/machine-pool.c index 167bcfad36..e7d19b10aa 100644 --- a/src/shared/machine-pool.c +++ b/src/shared/machine-pool.c @@ -42,6 +42,7 @@ #include "fd-util.h" #include "fileio.h" #include "fs-util.h" +#include "label.h" #include "lockfile-util.h" #include "log.h" #include "machine-pool.h" From db7d1dcae69d95583bfb275bc6895a0b3a5db983 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 19 Dec 2017 15:12:50 +0100 Subject: [PATCH 4/4] sd-bus: drop check for selinux before calling getsockopt(SO_PEERSEC) Quoting Lennart Poettering in https://github.com/systemd/systemd/pull/6464#issuecomment-319029293: > If the kernel allows us to query that data we should also be Ok with passing > it on to our own caller, regardless if selinux is technically on or off... The advantage is that this allows gcc to be smarter and reduce linkage: (before)$ ldd build/libnss_systemd.so.2 linux-vdso.so.1 (0x00007ffeb46ff000) librt.so.1 => /lib64/librt.so.1 (0x00007f2f60da6000) libcap.so.2 => /lib64/libcap.so.2 (0x00007f2f60ba1000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f2f60978000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2f60759000) libc.so.6 => /lib64/libc.so.6 (0x00007f2f60374000) /lib64/ld-linux-x86-64.so.2 (0x00007f2f61294000) libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007f2f600f0000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f2f5feec000) (after )$ ldd build/libnss_systemd.so.2 linux-vdso.so.1 (0x00007ffe5f543000) librt.so.1 => /lib64/librt.so.1 (0x00007f427dcaa000) libcap.so.2 => /lib64/libcap.so.2 (0x00007f427daa5000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f427d886000) libc.so.6 => /lib64/libc.so.6 (0x00007f427d4a1000) /lib64/ld-linux-x86-64.so.2 (0x00007f427e196000) Note that this only works in conjuction with the previous commit: either of the two commits alone does not have the desired effect on linkage. Replaces #6464. --- src/libsystemd/sd-bus/bus-socket.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c index 07a9c8affd..d72cb616e0 100644 --- a/src/libsystemd/sd-bus/bus-socket.c +++ b/src/libsystemd/sd-bus/bus-socket.c @@ -608,11 +608,9 @@ static void bus_get_peercred(sd_bus *b) { b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0; /* Get the SELinux context of the peer */ - if (mac_selinux_use()) { - r = getpeersec(b->input_fd, &b->label); - if (r < 0 && r != -EOPNOTSUPP) - log_debug_errno(r, "Failed to determine peer security context: %m"); - } + r = getpeersec(b->input_fd, &b->label); + if (r < 0 && r != -EOPNOTSUPP) + log_debug_errno(r, "Failed to determine peer security context: %m"); } static int bus_socket_start_auth_client(sd_bus *b) {