SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

namespace: fix MAC labels of /dev when PrivateDevices=yes

Browse Source 
Without changing the SELinux label for private /dev of a service, it will take
a generic file system label:
system_u:object_r:tmpfs_t:s0

After this change it is the same as without `PrivateDevices=yes`:
system_u:object_r:device_t:s0

This helps writing SELinux policies, as the same rules for `/dev` will apply
despite any `PrivateDevices=yes` setting.
This commit is contained in:
Topi Miettinen
2020-02-28 14:17:48 +00:00
committed by Topi Miettinen
parent 07336a0672
commit e6e81ec0a5
7 changed files with 40 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/smack-util.h
+5 -1
View File
@@ -29,7 +29,11 @@ typedef enum SmackAttr {
bool mac_smack_use(void);
int mac_smack_fix(const char *path, LabelFixFlags flags);
int mac_smack_fix_container(const char *path, const char *inside_path, LabelFixFlags flags);
static inline int mac_smack_fix(const char *path, LabelFixFlags flags) {
return mac_smack_fix_container(path, path, flags);
}
int mac_smack_fix_at(int dirfd, const char *path, LabelFixFlags flags);
const char* smack_attr_to_string(SmackAttr i) _const_;