From a119185c02d079ee1895033498fa2e073160fcac Mon Sep 17 00:00:00 2001 From: Axel Rasmussen Date: Mon, 3 Aug 2020 09:19:49 -0700 Subject: [PATCH] selinux: improve comment about getcon_raw semantics This code was changed in this pull request: https://github.com/systemd/systemd/pull/16571 After some discussion and more investigation, we better understand what's going on. So, update the comment, so things are more clear to future readers. --- src/core/selinux-setup.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c index 817069b3fe..40da8dd0e5 100644 --- a/src/core/selinux-setup.c +++ b/src/core/selinux-setup.c @@ -50,7 +50,10 @@ int mac_selinux_setup(bool *loaded_policy) { /* Already initialized by somebody else? */ r = getcon_raw(&con); - /* getcon_raw can return 0, and still give us a NULL pointer. */ + /* getcon_raw can return 0, and still give us a NULL pointer if + * /proc/self/attr/current is empty. SELinux guarantees this won't + * happen, but that file isn't specific to SELinux, and may be provided + * by some other arbitrary LSM with different semantics. */ if (r == 0 && con) { initialized = !streq(con, "kernel"); freecon(con);