SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
60,270 Commits 2 Branches 1 Tag
fd83c98e8a462b9b5ae07e3d7a2ace500b50c172
Commit Graph
14 Commits
Author SHA1 Message Date
Lennart Poettering 03bc11d1c4 mac: rework labelling code to be simpler, and less racy 
This merges the various labelling calls into a single label_fix_full(),
which can operate on paths, on inode fds, and in a dirfd/fname style
(i.e. like openat()). It also systematically separates the path to look
up in the db from the path we actually use to reference the inode to
relabel.

This then ports tmpfiles over to labelling by fd. This should make the
code a bit less racy, as we'll try hard to always operate on the very
same inode, pinning it via an fd.

User-visibly the behaviour should not change.
 2022-07-08 17:43:49 +02:00
Zbigniew Jędrzejewski-Szmek ce0458be09 smack: move helper function to smack-util.c 
The function was in basic/fileio.c, but it's more appropriate to
keep it out of src/basic.

Fixes compilation with -Dsmack-run-label= set.
 2021-09-21 18:31:42 +02:00
Zbigniew Jędrzejewski-Szmek b25a930f0e basic,shared: move a bunch of files to src/shared/ 
The goal is to move everything that requires selinux or smack
away from src/basic/. This means that src/basic/label.[ch] must move,
which implies btrfs-util.[ch], copy.[ch], and a bunch of other files
which form a cluster of internal use.

This is just moving text around, so there should be no functional difference.

test-blockdev-util is new, because path_is_encrypted() is moved to
blockdev-util.c, and so far we didn't have any tests for code there.
 2021-06-24 10:11:00 +02:00
Kay Sievers a095315b3c build-sys: split internal basic/ library from shared/ 
basic/      can be used by everything
            cannot use anything outside of basic/

libsystemd/ can use basic/
            cannot use shared/

shared/     can use libsystemd/
 2015-06-11 10:52:46 +02:00
WaLyong Cho 2ca620c4ed smack: introduce new SmackProcessLabel option 
In service file, if the file has some of special SMACK label in
ExecStart= and systemd has no permission for the special SMACK label
then permission error will occurred. To resolve this, systemd should
be able to set its SMACK label to something accessible of ExecStart=.
So introduce new SmackProcessLabel. If label is specified with
SmackProcessLabel= then the child systemd will set its label to
that. To successfully execute the ExecStart=, accessible label should
be specified with SmackProcessLabel=.
Additionally, by SMACK policy, if the file in ExecStart= has no
SMACK64EXEC then the executed process will have given label by
SmackProcessLabel=. But if the file has SMACK64EXEC then the
SMACK64EXEC label will be overridden.

[zj: reword man page]
 2014-11-24 10:20:53 -05:00
Lennart Poettering 376a298096 smack: we don't need the special labels exported, hence don't 2014-10-23 21:36:56 +02:00
Lennart Poettering 5dfc54615a smack: rework SMACK label fixing code to follow more closely the semantics of the matching selinux code 2014-10-23 21:36:56 +02:00
Lennart Poettering c80d766c80 mac: rename all calls that apply a label mac_{selinux|smack}_apply_xyz(), and all that reset it to defaults mac_{selinux|smack}_fix() 
Let's clean up the naming schemes a bit and use the same one for SMACK
and for SELINUX.
 2014-10-23 21:36:56 +02:00
Lennart Poettering 6baa7db008 mac: also rename use_{smack,selinux,apparmor}() calls so that they share the new mac_{smack,selinux,apparmor}_xyz() convention 2014-10-23 17:34:30 +02:00
WaLyong Cho cc56fafeeb mac: rename apis with mac_{selinux/smack}_ prefix 2014-10-23 17:13:15 +02:00
WaLyong Cho 66b6d9d5b5 label: rearrange mandatory access control(MAC) apis 
move label apis to selinux-util.ch or smack-util.ch appropriately.
 2014-10-23 17:10:05 +02:00
Łukasz Stelmach b9c1bc28eb smack: rework security labeling for multiple frameworks 2014-02-24 17:37:41 +01:00
Kay Sievers 9a4e038c15 smack: minimize ifdef use, and move all labeling to smack-util.c 2013-10-11 10:16:41 +02:00
Auke Kok 8552b17660 Smack: Test if smack is enabled before mounting 
Since on most systems with xattr systemd will compile with Smack
support enabled, we still attempt to mount various fs's with
Smack-only options.

Before mounting any of these Smack-related filesystems with
Smack specific mount options, check if Smack is functionally
active on the running kernel.

If Smack is really enabled in the kernel, all these Smack mounts
are now *fatal*, as they should be.

We no longer mount smackfs if systemd was compiled without
Smack support. This makes it easier to make smackfs mount
failures a critical error when Smack is enabled.

We no longer mount these filesystems with their Smack specific
options inside containers. There these filesystems will be
mounted with there non-mount smack options for now.
 2013-10-09 15:06:17 -07:00