From a3fee627074e030b4c32e0205818657381e5ae46 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Tue, 1 Apr 2025 10:38:14 +0200 Subject: [PATCH] core/service: ignore SELinux label errors in permissive mode Return -ENODATA instead of the raw error when SELinux is permissive, so the caller falls back to the default label. This is needed to allow relabeling service to start on systems where file contexts maybe invalid. --- src/core/service.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/core/service.c b/src/core/service.c index 012336b47a..8950eed539 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -6307,9 +6307,13 @@ int service_determine_exec_selinux_label(Service *s, char **ret) { log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring.", path); return -ENODATA; } - if (r < 0) - return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path); + if (r < 0) { + if (mac_selinux_enforcing()) + return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path); + log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s', SELinux in permissive mode, ignoring: %m", path); + return -ENODATA; + } return 0; }