Lennart Poettering
23e9a7dde5
Do not go back to disk on each selinux access, but instead cache the label off the inode we are actually reading. That way unit file contents and unit file label we use for access checks are always in sync. Based on discussions here: https://github.com/systemd/systemd/pull/10023#issuecomment-1179835586 Replaces: https://github.com/systemd/systemd/pull/23910 This changes behaviour a bit, because we'll reach and cache the label at the moment of loading the unit (i.e. usually on boot and reload), but not after relabelling. Thus, users must refresh the cache explicitly via a "systemctl daemon-reload" if they relabelled things. This makes the SELinux story a bit more debuggable, as it adds an AccessSELinuxContext bus property to units that will report the label we are using for a unit (or the empty string if not known). This also drops using the "source" path of a unit as label source. if there's value in it, then generators should manually copy the selinux label from the source files onto the generated unit files, so that the rule that "access labels are read when we read the definition files" is upheld. But I am not convinced this is really a necessary, good idea.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list or join our IRC channel.
Stable branches with backported patches are available in the stable repo.