SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/service: ignore SELinux label errors in permissive mode

Browse Source 
Return -ENODATA instead of the raw error when SELinux is permissive, so
the caller falls back to the default label. This is needed to allow
relabeling service to start on systems where file contexts maybe
invalid.
This commit is contained in:
Michal Sekletar
2026-07-31 11:30:32 +09:00
committed by Yu Watanabe
parent fb3581af65
commit a3fee62707
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/service.c
+6 -2
View File
@@ -6307,9 +6307,13 @@ int service_determine_exec_selinux_label(Service *s, char **ret) {
log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring.", path);
return -ENODATA;
}
if (r < 0)
return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path);
if (r < 0) {
if (mac_selinux_enforcing())
return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path);
log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s', SELinux in permissive mode, ignoring: %m", path);
return -ENODATA;
}
return 0;
}