From a1518f0a94e74d405ca72ed3c60335a4a03161a4 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 11 Jul 2025 11:46:08 +0900 Subject: [PATCH 1/2] selinux-util: downgrade log level to LOG_DEBUG when error code is zero Previously, the logger is only used in error paths, but since fe3f2ac0734e64dcd729b00992a6261cbf4cc846, the logger is also used in a success path. Let's not log loudly on success. This also drops unused log_selinux_enforcing(). --- src/shared/selinux-util.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h index d8df89d79e..e97bc40dcc 100644 --- a/src/shared/selinux-util.h +++ b/src/shared/selinux-util.h @@ -17,14 +17,14 @@ static inline void freeconp(char **p) { #define _cleanup_freecon_ _cleanup_(freeconp) -#define log_selinux_enforcing(...) \ - log_full(mac_selinux_enforcing() ? LOG_ERR : LOG_WARNING, __VA_ARGS__) - +/* This accepts 0 error, like _zerook(). */ #define log_selinux_enforcing_errno(error, ...) \ ({ \ - bool _enforcing = mac_selinux_enforcing(); \ - int _level = _enforcing ? LOG_ERR : LOG_WARNING; \ int _e = (error); \ + bool _enforcing = mac_selinux_enforcing(); \ + int _level = \ + ERRNO_VALUE(_e) == 0 ? LOG_DEBUG : \ + _enforcing ? LOG_ERR : LOG_WARNING; \ \ int _r = (log_get_max_level() >= LOG_PRI(_level)) \ ? log_internal(_level, _e, PROJECT_FILE, __LINE__, __func__, __VA_ARGS__) \ From 090c3f924c3ca08c6667a3101d49c3718f873622 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 11 Jul 2025 11:51:54 +0900 Subject: [PATCH 2/2] core/selinux-access: insert an empty line after function arguments Follow-ups for fe3f2ac0734e64dcd729b00992a6261cbf4cc846 and e3fef210c8903a9a3871ea5ba9b558b6cdbabea3. --- src/core/selinux-access.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c index 0181d88c72..ad8b1df8ae 100644 --- a/src/core/selinux-access.c +++ b/src/core/selinux-access.c @@ -217,6 +217,7 @@ static int check_access( const char *permission, struct audit_info *audit_info, sd_bus_error *error) { + bool enforce = mac_selinux_enforcing(); int r; @@ -335,6 +336,7 @@ int mac_selinux_access_check_varlink_internal( const Unit *unit, const char *permission, const char *function) { + _cleanup_freecon_ char *fcon = NULL, *scon = NULL; const char *tclass, *acon; int r;