SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

smack: introduce new SmackProcessLabel option

Browse Source 
In service file, if the file has some of special SMACK label in
ExecStart= and systemd has no permission for the special SMACK label
then permission error will occurred. To resolve this, systemd should
be able to set its SMACK label to something accessible of ExecStart=.
So introduce new SmackProcessLabel. If label is specified with
SmackProcessLabel= then the child systemd will set its label to
that. To successfully execute the ExecStart=, accessible label should
be specified with SmackProcessLabel=.
Additionally, by SMACK policy, if the file in ExecStart= has no
SMACK64EXEC then the executed process will have given label by
SmackProcessLabel=. But if the file has SMACK64EXEC then the
SMACK64EXEC label will be overridden.

[zj: reword man page]
This commit is contained in:
WaLyong Cho
2014-11-24 10:20:53 -05:00
committed by Zbigniew Jędrzejewski-Szmek
parent 8086ffacdb
commit 2ca620c4ed
10 changed files with 140 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+29
View File
@@ -1137,6 +1137,35 @@
</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>SmackProcessLabel=</varname></term>
<listitem><para>Takes a
<option>SMACK64</option> security
label as argument. The process
executed by the unit will be started
under this label and SMACK will decide
whether the processes is allowed to
run or not based on it. The process
will continue to run under the label
specified here unless the executable
has its own
<option>SMACK64EXEC</option> label, in
which case the process will transition
to run under that label. When not
specified, the label that systemd is
running under is used. This directive
is ignored if SMACK is
disabled.</para>
<para>The value may be prefixed by
<literal>-</literal>, in which case
all errors will be ignored. An empty
value may be specified to unset
previous assignments.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>IgnoreSIGPIPE=</varname></term>