SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

udev: reset Linux Security Module labels if no custom rules are given

Browse Source
This commit is contained in:
Kay Sievers
2013-10-09 04:26:41 +02:00
parent 753eff037e
commit b7e2b7641e
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/udev/udev-node.c
+16 -3
View File
@@ -283,6 +283,11 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
}
if (apply) {
bool selinux = false;
#ifdef HAVE_SMACK
bool smack = false;
#endif
if ((stats.st_mode & 0777) != (mode & 0777) || stats.st_uid != uid || stats.st_gid != gid) {
log_debug("set permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
chmod(devnode, mode);
@@ -291,8 +296,6 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
log_debug("preserve permissions %s, %#o, uid=%u, gid=%u\n", devnode, mode, uid, gid);
}
label_fix(devnode, true, false);
/* apply SECLABEL{$module}=$label */
udev_list_entry_foreach(entry, udev_list_get_entry(seclabel_list)) {
const char *name, *label;
@@ -301,11 +304,13 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
label = udev_list_entry_get_value(entry);
if (streq(name, "selinux")) {
selinux = true;
/* FIXME: hook up libselinux */
log_error("SECLABEL: failed to set selinux label '%s'", label);
#ifdef HAVE_SMACK
} else if (streq(name, "smack")) {
#ifdef HAVE_XATTR
smack = true;
if (lsetxattr(devnode, "security.SMACK64", label, strlen(label), 0) < 0)
log_error("SECLABEL: failed to set SMACK label '%s'", label);
else
@@ -315,6 +320,14 @@ static int node_permissions_apply(struct udev_device *dev, bool apply,
} else
log_error("SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
}
/* set the defaults */
if (!selinux)
label_fix(devnode, true, false);
#ifdef HAVE_SMACK
if (!smack)
lremovexattr(devnode, "security.SMACK64");
#endif
}
/* always update timestamp when we re-use the node, like on media change events */